Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese-language job-reporting helper that gathers public recruiting information and writes reports, with some setup choices users should review.
Before installing, confirm the output directory and only enable the weekly automation if you want recurring web searches and local report files. Expect the skill to browse public recruiting sources and generate Chinese-language reports.
The skill is designed to automatically collect information from company sites, job platforms, and public accounts, which implies network access to multiple external sources without clearly warning the user. In an automated scheduled context, this can trigger unexpected outbound requests, expose usage metadata, and retrieve untrusted content that may influence downstream outputs.
The skill instructs the agent to save generated reports to a specific local filesystem path on the host without clearly notifying the user or constraining writes to a safe workspace-relative location. This can cause unexpected file creation on the machine, overwrite existing content, or leak collected data into an uncontrolled location during automated runs.
This HTML template sets the document language to zh-CN and all visible interface text is written in Chinese, which enforces a specific language/locale for users. The file does not provide any opt-in, alternate locale option, or justification that this is a region-specific skill, so it conflicts with the language/locale policy criteria.
This markdown file presents all headings, descriptions, and list content in Chinese, which effectively forces a specific language for users. Under the stated policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.
The entire skill reference is written in Chinese, including headings, descriptions, and search keywords, with no indication that language selection is optional or that the file is intended only for Chinese-speaking users. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in or documented regional justification.
No suspicious patterns detected.
