Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language aquarium care helper with no executable code or hidden privileged behavior, though users should treat fish-disease and sensor/photo features as advisory.
Install only if you want a Chinese-language aquarium helper. For fish illness or treatment advice, use it as a starting point rather than a definitive diagnosis, and be cautious about sharing photos or sensor data unless the host app clearly explains processing and retention.
The natural-language content of the README is presented only in Chinese, which can amount to a language/locale policy issue when the skill does not provide user opt-in, alternatives, or a stated region-specific justification. The file does not indicate that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context.
The metadata trigger list contains broad, everyday aquarium-related terms such as '喂食', '换水', and '养鱼' without constraints, which can cause unintended activation outside the author's intended context. Overbroad invocation increases the chance the skill responds when users did not explicitly request it, leading to confusing or unsafe advice being surfaced inappropriately.
The markdown trigger section repeats a large set of ambiguous phrases with no scope constraints, reinforcing the risk of accidental activation from normal conversation about fish tanks. In a skill that can provide diagnostic and care guidance, accidental triggering can expose users to advice they may over-trust or did not ask for.
The skill advertises AI fish disease recognition and treatment suggestions from uploaded photos but does not warn that results may be inaccurate or non-authoritative. Users may act on a false diagnosis, applying the wrong treatment, harming livestock, degrading water conditions, or delaying proper expert help.
The trigger list contains broad, common terms such as '水族', '养鱼', and '鱼缸', which can cause the skill to activate in conversations that only generally mention aquariums rather than explicitly invoking this skill. This increases the risk of unintended routing, over-collection of user context, and confusing or unsafe responses if the skill is triggered outside the user’s intent.
The file consists entirely of Chinese headings and output templates, which implies the skill will respond in Chinese by default. The policy requires avoiding forced language or locale constraints unless the user is given a choice or the constraint is clearly documented and justified.
The description and usage content appear to assume Chinese as the required interaction language, but the file does not state that this is a China/Chinese-only skill or offer language choice. This can be a natural-language policy issue when a skill effectively forces a language without user opt-in or justification.
The skill describes photo uploads and sensor-based monitoring but provides no notice about what data is collected, stored, shared, or retained. Even though aquarium data is generally low sensitivity, images and device telemetry can still reveal household environment details and create avoidable privacy risk.
The description, category, tags, trigger phrases, and features are all presented in Chinese, which implies a fixed language experience. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking locale.
No suspicious patterns detected.
