Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed company/stock summary helper with bounded inputs and no artifact-backed evidence of hidden access, persistence, or destructive behavior.
Install this if you want a Chinese-language company/stock snapshot skill. Review that it may be implicitly invoked for matching finance questions and that it returns market, valuation, growth, quality, and shareholder data through the Winmale skill runtime; it does not appear to trade, modify accounts, install code, persist data, or read local credentials.
The file’s user-facing name, description, and operating instructions are all presented only in Chinese, and there is no statement that the skill is region-specific or that users may opt into another language. This can violate language/locale policy when a skill implicitly forces one language without user choice.
The manifest description is written entirely in Chinese and presents the skill as operating in that language, with no indication that users may choose another language or locale. Under the policy for natural-language violations, a skill that imposes a language without user opt-in should be flagged unless the locale restriction is explicitly documented and justified.
The skill enables allow_implicit_invocation without any visible trigger restrictions or narrowing conditions, so the platform may auto-select this skill in broader contexts than intended. Because this skill appears to provide company analysis and market/valuation information, ambiguous activation could cause unintended use, prompt-routing mistakes, or leakage of user context into the wrong skill execution path.
The manifest presents the skill name, description, category, summary, and sample prompts entirely in Chinese, which implies a fixed language/locale for user interaction. The file does not offer an alternative language option or document that the skill is intentionally limited to Chinese-speaking users for a justified regional purpose.
