Security audit
Security checks for vulnerabilities and agentic risk
This skill locally analyzes user-provided product feedback files to score requirement validity, with no evidence of hidden network access, persistence, credential use, or unrelated behavior.
Install this if you are comfortable running a local Python tool over product feedback data. Review any CSV/JSON content for sensitive user information before use, and provide explicit input and output paths when generating reports.
The entire skill description and usage guidance are presented only in Chinese, with no indication that users may choose another language or that the skill is intended exclusively for a Chinese-speaking or region-specific context. This creates a natural-language locale constraint that is not presented as optional or justified.
The skill advertises executable usage that reads user-supplied CSV files and references editable configuration, but it does not declare an explicit tool/permission scope for file access. That mismatch can cause over-broad runtime assumptions or bypass governance checks, increasing the chance that the agent reads or writes files beyond what users expect.
The skill’s natural-language description and usage instructions are presented entirely in Chinese, which can amount to forcing a specific language on users without opt-in. The file does not mention language options, multilingual support, or a justified region-specific constraint.
The invocation example uses a very broad natural-language trigger (e.g. '帮我验证"导出PDF"这个需求') without clear activation boundaries, which can cause accidental or implicit skill activation in unrelated conversations. In an agent environment, ambiguous triggering can lead to unintended data requests or file processing based on casual user text.
This Python file contains its primary description and user-facing interface text exclusively in Chinese, beginning with the module docstring and continuing throughout CLI help/messages. That can violate language/locale policy when the skill forces a specific language without giving the user a choice or documenting a justified locale constraint.
This YAML file uses Chinese-only natural-language labels and comments throughout, such as the section headers and metric descriptions. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint can be a natural-language policy violation.
The competitor names are encoded only in Chinese (e.g. "竞品A", "竞品B", "竞品C"), which reflects a fixed language choice in the skill data. Because SQP-3 applies to all file types and there is no indication here of user opt-in or a documented region-specific constraint, this can be a locale-policy concern.
No suspicious patterns detected.
