Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only local business promotion skill whose contact-detail collection is disclosed and purpose-aligned, though users should only provide information meant for public release.
Install only if you want help creating public local-business promotion content. Provide only contact details you are authorized to publish, avoid personal or residential information unless it is already intended for public business listings, and verify all generated claims before posting.
The README asks users to provide sensitive business-identifying and contact information, including exact address, phone number, and licensing details, but gives no guidance on minimization, storage, retention, sharing, or redaction. In an agent skill context, this can lead users to expose data unnecessarily to the tool, model provider, logs, or downstream systems without informed consent.
The skill explicitly requests and reproduces sensitive business contact data, including exact address and phone number, in generated content without any warning, consent check, minimization guidance, or handling restrictions. While this is framed as local-business promotion, the workflow encourages broad redistribution of identifiable contact details, which can create privacy, scraping, harassment, or doxxing risks if the data is personal, home-based, or submitted without proper authorization.
The README states the skill is optimized for Chinese local business search patterns, which is a locale-specific constraint. Because the file does not clearly present this as an explicit opt-in or narrowly justified regional limitation in the activation/instruction context, it can be read as a locale policy constraint without user choice.
No suspicious patterns detected.
