Security audit
Security checks for vulnerabilities and agentic risk
This is a China-focused investment-analysis skill with a simple local script, and I found no hidden persistence, credential access, network use, or destructive behavior.
Install only if you want a Chinese-language, China-focused investment analysis framework. Treat its conclusions as a starting point for research, not as personalized financial, legal, or compliance advice, and verify any company-specific claims with current independent sources before acting.
The README content is entirely in Chinese, including headings, usage steps, and descriptions, with no indication that users may choose another language or that the skill is region-specific. Under the language/locale policy rule, this is a natural-language policy concern because it imposes a specific language by default.
The skill’s activation description is overly broad, using triggers like analyzing Chinese investment opportunities, identifying 'core assets,' modernization analysis, or applying a named theory without clear scoping constraints. This can cause the agent to invoke the skill in loosely related financial contexts, increasing the chance of inappropriate financial guidance, ideological framing, or overconfident investment analysis being applied where a more neutral or regulated response is needed.
This file contains user-facing docstrings and printed output exclusively in Chinese, which effectively forces a specific language for interaction. Under the policy, locale or language constraints should be optional or clearly justified; neither is present here.
This markdown template forces a specific language/locale for all users through its headings, labels, and instructions. The file does not indicate that Chinese is optional, user-selected, or justified as a region-specific requirement, which can violate language/locale policy expectations.
No suspicious patterns detected.
