Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed China-market marketing planner with a small benchmark API script and no evidence of hidden persistence, credential access, or destructive behavior.
Install this if you want China-focused marketing strategy help and are comfortable with benchmark lookups using a disclosed external Tencent Cloud API. Avoid sending confidential campaign drafts or business-sensitive data to any API endpoint unless you have reviewed the provider and privacy expectations.
The skill advertises an executable shell script (scripts/benchmarks.sh) and real API-backed behavior, but declares no explicit tool scope or permissions. That creates a mismatch between documented capabilities and governance, increasing the risk that an agent may invoke shell/network actions without clear user awareness or policy constraints.
The trigger list includes broad terms like 'marketing strategy', 'budget allocation', and 'KPI framework', which are common in ordinary requests and may cause the skill to activate unexpectedly. Overbroad auto-invocation can route unrelated user prompts into a skill that encourages external API/script usage and a fixed domain-specific workflow without clear consent.
The markdown explicitly describes a real external API backend and CLI script usage but does not warn users that benchmark retrieval may involve outbound network access to a third-party endpoint. Hidden or insufficiently disclosed external access can expose user-provided business data, query contents, and operational metadata to external infrastructure.
The natural-language description frames the skill as a Chinese marketing strategy planner and the assistant role as a senior Chinese digital marketing strategist, but it does not indicate that users can choose another language or locale. This can violate language/locale policy when a specific locale is imposed by default without opt-in or a clearly documented region-specific constraint.
No suspicious patterns detected.
