Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a Chinese business coaching workflow, but it adds off-platform activation and persistent local business-progress logging that users should review before installing.
Install only if you are comfortable with a Chinese-language coaching skill that asks you to create a local activation ID, send that ID to the author for registration, and keep local learning logs about business progress. Avoid storing confidential client, financial, or personally identifying details in the learning log, and review or remove ~/.yihaiyoudao/activate.json and artifact/memory/learning-log.md if you do not want persistent state.
The manifest presents the skill as strategic coaching, but the instructions add an unrelated activation and author-registration workflow that generates a unique local identifier and writes persistent state. This mismatch undermines informed consent and can be used to collect install telemetry or impose off-platform control not expected from the stated purpose.
The skill directs the agent to run local scripts and write files, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where a seemingly harmless coaching skill can perform filesystem reads/writes without clear user visibility or least-privilege constraints.
The description says to use the skill whenever the user wants media/entrepreneurship/growth help or merely mentions income goals like 年入/月入 10万、100万、1000万. This scope is very broad and lacks explicit trigger boundaries or negative examples, so ordinary conversation about business goals could unintentionally invoke the skill.
An activation gate requiring the user or agent to generate an installation ID and contact the author is unrelated to strategic coaching and introduces unnecessary tracking and external dependency. Even if described as local-only, it conditions full functionality on an off-platform registration step, which is risky and privacy-invasive.
The skill instructs the AI to retain milestone completion, lessons learned, and progress details across sessions in a local learning log. Cross-session persistence of user business data can expose sensitive personal or commercial information, especially when the retention policy, minimization rules, and access boundaries are not defined.
The file explicitly instructs operators to append 'new experience' after each use and to promote repeated experiences into the skill or lexicon, which creates a retention and propagation path for information derived from user interactions. Without minimization rules, redaction requirements, or user notice/consent, this can lead to storage of sensitive user details and reuse of those details in future behavior.
The script implements a licensing/activation workflow that requires the user to generate a local identifier and contact the author for authorization, which is unrelated to the advertised strategic coaching functionality. This introduces an undeclared access-control and user-tracking mechanism into the skill package, increasing trust and privacy risk because users must interact with the author outside the platform to unlock full functionality.
This file contains all usage and activation guidance in Chinese only, including the docstring and runtime messages. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly documented as region-specific or optional.
The docstring states the installation number is 'not uploaded or sent out', but the script explicitly instructs the user to send that identifier to the author for registration. This is misleading about data handling and can cause users to disclose identifiers under false privacy expectations, which is especially concerning in an AI skill context where trust disclosures should be accurate.
The script’s user-facing description, argument help text, generated roadmap content, and log messages are all hard-coded in Chinese. This imposes a specific language on all users with no opt-in or alternative locale path, which matches the language/locale policy violation criteria.
The markdown tells the agent to run a script that creates a local activation file, but it does not provide a clear, prominent warning about the filesystem write or require explicit consent at the moment of action. Silent or poorly disclosed local writes reduce user awareness and can normalize unsafe agent behavior.
The skill instructs the agent to persist learning logs and update local files as part of routine use, despite being presented primarily as a coaching workflow. Persistent state changes are not inherently malicious, but they create privacy and integrity risks when not narrowly scoped, disclosed, and user-approved.
The title and instructions are fully in Chinese, which may impose a language constraint on users or maintainers without any opt-in or explanation. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is documented and justified.
This markdown file contains user-facing guidance exclusively in Chinese, and there is no indication that the user can opt into another language or that the locale restriction is required by the skill's purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The top-level documentation frames the script as an automated roadmap generator based on reference data, but the implementation includes an additional stateful logging feature via --note and log_learn(). This is not merely omitted detail about formatting; it changes the tool from pure generation to generation plus persistence.
The manifest describes a strategic coaching skill that diagnoses goals, designs paths, and supports review, but it does not disclose that the script writes a persistent local memory file. While logging may support long-term coaching, this storage side effect is a distinct operational behavior not reflected in the skill description.
No suspicious patterns detected.
