Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed daily briefing skill with limited workspace and network access; its main caution is optional recurring scheduling and push behavior.
Install only if you want a Chinese-first daily briefing workflow with workspace Markdown output. Before enabling daily push or cron behavior, confirm the schedule, recipient, output path, and how to disable it. Treat the SECURITY.md script audit as stale because no script is included in this artifact.
The example trigger phrases are broad natural-language requests such as generating today's briefing or setting a daily schedule, which can easily overlap with ordinary user intent in unrelated contexts. In an agent environment, this can cause the skill to activate unexpectedly, leading to unreviewed execution paths such as scheduled automation or file generation without clear user awareness.
This markdown file contains substantial policy and operational content in Chinese, including audit results, deployment notes, and the final verdict, but it does not state that the skill is Chinese-only or give users an opt-in language choice. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
The description and usage are entirely framed around Chinese-language output for a general-purpose daily briefing skill, but there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese locale. This can violate language/locale policy when a skill imposes a specific language without opt-in.
The invocation examples are broad natural-language phrases such as generating a briefing or setting a daily push, without clear trigger boundaries or confirmation requirements. This can cause the agent to activate in unintended contexts or interpret casual user text as permission to create files or configure scheduled tasks, increasing the risk of surprise actions and overreach.
The natural-language content and usage examples are presented in Chinese, while the file indicates “English” via a separate link rather than offering language choice within the skill instructions themselves. This can be interpreted as a locale/language default without explicit user opt-in.
