Security audit
Security checks for vulnerabilities and agentic risk
This Markdown-only skill includes disclosed profile and promotional content, but it has no executable behavior, persistence, or privileged access.
Install this only if you want both number-6 cultural information and the included Chen Lang/OpenClaw profile material. Be aware the skill may surface contact details or project links when activated, but it does not contain code or request special access.
The activation description is broad enough to cover both cultural queries and profile-related topics, even though those are materially different intents. Ambiguous routing increases the likelihood that the skill activates in contexts where users did not request personal-profile or promotional content, causing oversharing and inappropriate responses.
The skill’s declared purpose is cultural information about the number 6, but a large portion of the file is unrelated personal-profile and ecosystem promotion content. This creates scope drift that can cause the agent to disclose unrelated personal or promotional material when users ask innocuous cultural questions, enabling stealthy advertising or data exposure under a misleading skill description.
Including direct contact information and external URLs in a skill that is supposed to explain cultural meaning is unnecessary and increases the chance the agent will surface personal data or drive users to external properties without clear consent. In agent environments, this can be abused for unsolicited outreach, promotion, phishing-adjacent trust building, or off-platform redirection.
The description states the skill is a Chinese-English version, and the document consistently presents bilingual output by default. This can violate language-choice policy because it imposes a specific language format rather than offering the user a choice or making bilingual output optional.
No suspicious patterns detected.
