Security audit
Security checks for vulnerabilities and agentic risk
This fishing assistant is mostly coherent, but it needs review because it can accumulate location-linked fishing logs without clear privacy controls and includes guidance around bait it labels illegal.
Review this skill before installing if you do not want fishing photos, location, weather context, or catch history accumulated without explicit controls. Users should also verify local fishing regulations and avoid relying on any bait recommendation that may be illegal or restricted.
Nearly all user-facing instructions, trigger phrases, and examples are presented only in Chinese, while the skill description contains only a brief English gloss. This effectively constrains use to a specific language without stating that the skill is Chinese-only or offering users a language/locale choice.
The skill explicitly describes handling photos, city or location information, weather-derived context, and persistent fishing logs, but it does not document consent, retention, sharing, or deletion practices. Because these data points can reveal travel patterns, frequented locations, and behavioral history, the absence of user-facing privacy controls creates a real privacy and data-governance risk.
The trigger phrases include common conversational expressions such as '今天适合钓鱼吗' and '帮我分析鱼情', which can plausibly appear in ordinary chat and may cause unintended activation. Unintended activation can lead to unnecessary processing of user messages, images, or location-related context, increasing privacy exposure and confusing routing behavior.
This YAML knowledge file is entirely written in Chinese and provides no indication that the skill is region-specific or that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
The knowledge base explicitly includes an illegal bait option ('泥鳅') and labels it as prohibited, but still documents the fish targets and frames it as an effective method. In a fishing-assistant context, operational guidance about an illegal technique can normalize or enable unlawful behavior even if accompanied by a warning, making this a real policy and safety issue.
The file’s title and all descriptive content are written entirely in Chinese, with no indication that users can choose another language or locale. This can violate language/locale policy when a skill is expected to support broader users unless the regional constraint is explicitly documented and justified.
This YAML knowledge-base uses Chinese-only headings and fish descriptions, which can amount to a language/locale policy issue when a skill implicitly forces one language for users. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose.
This manifest-style YAML file presents all substantive guidance in Chinese and does not indicate that the user can select another language. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
No suspicious patterns detected.
