Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed AppGallery reporting workflow that reads user-provided app lists, queries public app-store information, and returns a PDF report.
Install this if you are comfortable with the agent reading the app names and optional update dates from attached Excel files when you use the stated monitoring keyword, operating AppGallery through a phone GUI, and returning a generated PDF report. Avoid attaching spreadsheets with unrelated sensitive columns even though the skill says they are ignored.
The trigger phrases include broad, natural requests like '查一下这些 App 的更新情况' and '帮我查应用市场的版本', which can match ordinary user messages and cause the skill to activate unexpectedly. In this skill, unexpected activation is more concerning because it can drive a GUI agent and generate reports, increasing the chance of unintended automated actions on user-supplied data.
The one-click mode automatically parses attached Excel files when the keyword appears, but the skill does not prominently warn users that attachments will be ingested and processed without further confirmation. This is dangerous because users may mention the keyword casually while sharing spreadsheets, leading to unintended processing of potentially sensitive business data and downstream report generation.
