Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent AI-company public relations and crisis-response prompt package, with broad but purpose-aligned permissions users should control carefully.
Install only if you want an agent to help with PR and crisis-response workflows. Keep human approval on for public statements, regulator or customer notifications, file writes, and any network or messaging actions, because the skill's permission declarations are broader than its operational details.
The trigger list contains broad terms such as "公共关系", "CPO", and "品牌声誉" that can match many unrelated conversations and cause the skill to activate unexpectedly. In an agent setting, overbroad invocation increases the chance that the skill gains access to its file/network capabilities or influences workflows when the user did not specifically request crisis/public-relations automation.
The skill requests write and network/API permissions, plus messaging/session capabilities, but the user-facing description does not clearly disclose why these are needed or what actions may be taken. This reduces informed consent and makes accidental or opaque data exfiltration, external communications, or unintended file modification more plausible if the skill is invoked during sensitive PR or incident-handling workflows.
No suspicious patterns detected.
