Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed business feasibility-study workflow with simple local analysis scripts, though users should be mindful about saving research materials locally.
Install this if you want a Chinese-language feasibility-study coach that performs web-backed research, creates structured reports, and uses local templates/scripts. Before using it with confidential projects, decide where source materials may be saved, avoid storing sensitive raw documents unnecessarily, and keep web collection within legal and site-policy limits.
The skill instructs use of local file outputs and references scripts/templates that imply file write behavior, but it does not declare any tool scope or permissions boundary. That creates an authorization ambiguity where an agent may write files or persist artifacts without explicit least-privilege constraints or user awareness.
The display name, description, and the full operating instructions are all presented in Chinese, and the skill does not indicate that language should follow user preference or provide an opt-in choice. Under the stated policy, forcing a specific language without user choice can be a locale-policy issue unless clearly justified as region-specific.
The activation triggers are very broad and overlap with ordinary business-analysis requests, so the skill may auto-activate in contexts the user did not intend. Over-broad activation can cause the agent to apply prescriptive workflows, perform unnecessary data gathering, or invoke more powerful behaviors than needed for a simple request.
The skill explicitly directs the agent to save gathered source materials locally for later reuse, but it provides no privacy, retention, or sensitive-data handling guidance. This can lead to unnecessary persistence of scraped content, proprietary documents, personal data, or regulated information beyond the immediate task scope.
This code file contains extensive natural-language text in the module docstring that fixes the interaction language to Chinese. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the restriction is clearly justified or optional.
This Python file’s module docstring, schema help text, error messages, and rendered output are all written in Chinese, and the CLI provides no option to select another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.
SQP-3 applies to all file types and includes language or locale policy violations. This file presents all user-facing instructions only in Chinese, with no opt-in, alternative language, or justification that the skill is intended solely for a Chinese-language audience.
SQP-3 applies to all file types and includes language or locale policy violations. This markdown template presents all instructions and examples only in Chinese, with no user opt-in, alternative language option, or justification for restricting the skill to a Chinese-speaking audience.
No suspicious patterns detected.
