Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it claims, but it requires an out-of-band registration ID and stores customer follow-up notes locally without enough privacy controls.
Review this before installing if you do not want to share an installation code with the author or keep customer follow-up notes in local files. Avoid entering sensitive personal, financial, or confidential client details unless you control the storage location and retention process.
The manifest presents this as a customer follow-up/conversion assistant, but the body adds a separate activation and registration workflow that generates a unique installation identifier and requires contacting the author for authorization. That behavior is outside the stated purpose and can surprise users into sharing metadata or accepting hidden control logic they did not consent to.
The script introduces host-specific activation and authorization tracking that is unrelated to the declared customer follow-up/conversion function of the skill. Even though it does not automatically exfiltrate data, it creates a local identifier tied to a user installation and instructs manual transmission to the author, which is a privacy and supply-chain trust concern, especially because use of the skill is gated on out-of-band registration.
The skill instructs the agent to read and write local files via activation, logging, and client-profile maintenance, but it declares no explicit tool scope or permissions boundary. That increases the chance of unexpected file access and makes it harder for a host platform or user to understand what local data the skill may touch.
The trigger conditions are broad natural-language phrases that could cause the skill to activate in contexts beyond intended customer-followup tasks. Over-broad activation raises the risk of the skill handling unrelated conversations, exposing or modifying customer records, or steering the agent into sales behavior unexpectedly.
The mandatory activation flow gates core functionality on author registration and instructs users to send a generated installation code to an external party. This introduces an unnecessary external dependency and creates a channel for metadata collection and user tracking unrelated to the skill's core business logic.
The skill tells users to replace placeholders with real customer data and maintain ongoing profiles and follow-up notes, but it provides no warning about handling personal, financial, or business-sensitive information. In a sales/coaching context, this can lead to unsafe storage of client PII, confidential deal status, and behavioral notes without consent, minimization, or retention controls.
The file’s title and operational instructions are entirely in Chinese, indicating the skill’s learning log is expected to be maintained in a specific language. There is no indication that users may choose another language or that the locale restriction is optional or justified, which can violate language/locale policy requirements.
The docstring states the installation number is 'not uploaded or sent out,' but the script later tells the user to send that number to the author for registration. This contradiction is dangerous because it misleads users about data handling and consent, undermining trust and potentially causing users to disclose identifiers they were told would remain local.
The example client records use Chinese-only values for identifiers and workflow fields such as paid status, blockers, direction, and next action. For a generally reusable example JSON file, this hard-codes a language/locale without any stated opt-in or documented region-specific justification, which can violate language-choice policy.
All user-facing strings, instructions, and generated follow-up messages are hardcoded in Chinese, and the script reconfigures stdout for UTF-8 output. There is no indication that the skill is region-specific or that the user can opt into another language, which violates the language/locale choice policy.
The docstring says 'L1 观望层不追单', implying observation-tier clients should not be actively followed up. However, daily() excludes L1 clients only when days_since_action < 7, and message() explicitly generates a direct message for L1/L2 clients with days >= 7, so some L1 clients are still pursued.
The script persists free-form follow-up notes into a long-lived learning log outside the immediate follow-up task flow, creating data retention beyond what the described skill functionality clearly requires. Because operators may include sensitive client details, this expands the privacy and disclosure surface and can unintentionally turn transient CRM-style usage into undeclared local profiling or memory accumulation.
Customer follow-up notes are appended to a persistent markdown log without explicit consent, visibility, or safeguards, and those notes can easily contain personally sensitive business context. In a client-management skill, silent local retention increases the chance of privacy violations, accidental disclosure, and over-collection of customer data.
The instructions direct users to send an installation identifier to the author but do not explain the privacy implications, whether the identifier can be linked to a person/device, or how it will be used and retained. This creates a consent and transparency gap around external sharing, even if the identifier is not highly sensitive by itself.
The manifest frames this as a standalone customer follow-up and conversion skill, but the documentation instructs users to invoke a separate pi-jev decision-layer skill for task routing. That cross-skill orchestration capability is not part of the manifest’s described scope and changes the effective behavior beyond customer follow-up operations.
No suspicious patterns detected.
