Security audit
Security checks for vulnerabilities and agentic risk
This is a proposal-writing helper with no executable code, persistence, credential access, or hidden behavior found.
Before installing, users should be comfortable providing freelance profile details, portfolio links, rates, and project descriptions to the agent context. Avoid including client secrets, private account data, confidential pricing arrangements, or unpublished client materials unless they are redacted.
The skill description and all usage guidance are presented entirely in Chinese, with no indication that other languages are supported or that the Chinese-only scope is intentional and justified. This can violate language/locale policy when users are not given an explicit language choice or opt-in.
The trigger list includes broad phrases such as '写提案', '投标', and '自由职业' that can appear in ordinary conversation, making accidental or overly broad skill activation plausible. In an agent environment, unintended invocation can cause inappropriate handling of user context or proposal/profile data even though the skill itself is not overtly malicious.
The skill encourages use of personal profile details, case links, pricing, and proposal history but does not warn users about sharing sensitive or confidential information. This increases the risk that users may provide private client data, personally identifiable information, or commercially sensitive pricing/history to the skill without understanding the exposure.
The skill instructions, feature descriptions, triggers, and usage guidance are written entirely in Chinese, which effectively forces a specific language experience. There is no indication that users may choose another language or that the Chinese-only presentation is an intentional, justified regional constraint.
No suspicious patterns detected.
