Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed audience-analysis API wrapper with no executable code or hidden persistence.
Install this only where sending audience behavior and content performance data to the configured audience-analysis API is appropriate; consider narrowing activation wording or documenting language support for user clarity.
The trigger conditions are broad enough that the skill may activate for loosely related requests such as any audience analysis or generic 'analyze' task, increasing the chance of inappropriate invocation. Over-broad activation can cause unintended access to behavior or performance data and may route user tasks to this skill without clear user intent.
The natural-language description combines Chinese and English instructions ('根据历史表现数据分析... Use when analyzing audience...') without stating whether the user can choose their preferred language or locale. This may violate language-policy expectations if the skill implicitly forces or defaults to a language presentation style without opt-in.
The manifest uses a Chinese-only skill name, "受众画像分析", and the file provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy expectations when users are not given a choice or an explicit justification for the locale constraint.
No suspicious patterns detected.
