Security audit
Security checks for vulnerabilities and agentic risk
CityScout is a plain Markdown planning skill for urban site visits, with no executable code, persistence, credential handling, or hidden behavior found.
Installers should understand that this skill is designed around Chinese-language urban fieldwork and Amap-based location data. If used with real API access, location queries may be sent to Amap as part of normal route planning; no API key or executable integration is included in the artifact.
The README is written entirely in Chinese and does not indicate that other languages are supported or that Chinese is a required locale for a region-specific compliance reason. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The listed triggers "帮我规划调研路线" and "帮我看这个地块周边" are generic enough to overlap with many ordinary planning or location-analysis requests, not just this specific fieldwork skill. The file does not provide exclusion conditions or negative examples to narrow when these phrases should or should not activate the skill.
The mandated output template uses Chinese section headings and examples, which effectively imposes a specific language in the skill’s response format. The file does not state that Chinese is optional, user-selected, or required for a region-specific compliance reason.
The markdown content presents all headings and instructions only in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language option is provided. There is no indication that this file is intended exclusively for a Chinese-speaking or region-specific audience.
The entire prompt example is written in Chinese and presents the expected interaction and output format only in that language. This can violate a language/locale policy when no user choice or opt-in is provided and no region-specific justification is documented in the file.
No suspicious patterns detected.
