Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed simulated membership and restaurant analytics reference skill; it contains sensitive-style schemas but no hidden execution, persistence, or exfiltration behavior.
Install only if you want a Chinese-first membership and chain-restaurant analytics reference skill. Treat its schemas as templates, not permission boundaries: when adapting it to real data, use read-only scoped credentials, mask or tokenize identifiers, avoid exporting member or employee-level rows into prompts or group chats, and validate all SQL and business rules before production use.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# majia-huiyuan · Membership Ops Playbook <!-- plain-ok -->
[](./SKILL.md)
[](./LICENSE)
The file title and core guidance are written in Chinese, and L3 instructs the agent to answer in a specific style for its users without indicating that other languages are allowed. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
The schema substantially exceeds the stated会员/私域数据顾问 scope by including franchisee profitability, contract, investment, settlement, and store financial analytics. This kind of scope expansion violates least-privilege/data-minimization principles and increases the chance that an agent using this skill can access or reason over sensitive business-financial datasets unrelated to the user’s requested membership analysis.
The comment naming=zh explicitly fixes the schema naming language to Chinese, which is a locale/language constraint in natural-language metadata. The file does not offer a language choice or explain that the schema is intentionally region-specific, so this appears to violate the policy against forcing a specific language without opt-in.
The manifest describes a skill focused on 会员指标、RFM、留存/流失、会员分层、标签体系、CDP/OneID、私域/CRM会员分析 and related data support for member operations. This DDL also defines tables for 加盟商单店报告、单店利润健康 and other franchise/store P&L analytics, which are separate business domains not justified as implementation details of member analytics.
The manifest frames this skill as a member data consultant that provides data basis for会员运营 actions, while execution and broader private-domain operations are delegated elsewhere. Tables such as dwd_投诉, dwd_评价, dws_体验口碑汇总, and ads_异常归因清单 introduce customer service, reputation, and operational exception-analysis capabilities beyond the declared member-metrics and segmentation purpose.
The comment naming=zh establishes a language/locale constraint for schema naming, and the rest of the file consistently uses Chinese identifiers. Under the policy, forcing a specific language or locale without opt-in or a documented region-specific justification is a natural-language policy violation.
The schema materially exceeds the skill's declared membership-data advisory scope by including franchise operations, profitability, investment, payback, and cost-accounting domains. This violates least-privilege and data-minimization principles, increasing the chance that the skill can access or infer sensitive business data unrelated to its stated purpose.
These tables model franchise contracts, settlement details, commission rates, fees, deposits, and headquarters revenue, which are highly sensitive commercial records unrelated to member advisory tasks. If the skill can query or reason over this data, it expands exposure from customer analytics into confidential financial and contractual intelligence.
The schema adds investment, profitability, and payback-analysis capabilities that are outside the skill's member-operations purpose, enabling broader strategic or financial analysis than users would expect. Even without direct exfiltration, this creates unauthorized access paths to sensitive business insights and weakens boundary separation between business functions.
The comment naming=zh declares a fixed Chinese naming scheme for the generated schema. This is a natural-language locale constraint presented without offering a user choice in this file, which can violate language/locale policy when a skill forces one locale by default.
The manifest describes a skill focused on member metrics, segmentation, CRM/private-domain member analysis, CDP/OneID, and data support for member operations. This DDL also defines broad franchise, store P&L, cost structure, investment payback, complaints/reviews, product sales, and executive operations schemas such as ads_加盟商单店报告, ads_单店利润健康, dws_加盟回本测算, and dws_商品销售分析, which materially exceed a member-focused analytics contract.
The skill processes and outputs identifiable member and employee data, including member IDs, cities, employee IDs, names, roles, and behavioral task outcomes, but provides no user-facing warning or privacy handling guidance. In a data-analysis skill focused on membership operations, this omission increases the risk of inappropriate exposure, over-sharing, or downstream misuse of sensitive business and personal data.
Line L001 states the agent is an ETL expert and presents all instructions in Chinese, effectively fixing the interaction locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The file is written as an instruction prompt beginning with Chinese-only guidance ('你是一个ETL专家...') and provides no indication that the user may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Line L001 is written as a direct instruction to the assistant and constrains the behavior of the skill in Chinese, but the file does not offer any user language choice or explain that the skill is intended only for a Chinese-speaking or China-specific environment. This is a natural-language locale policy issue because it imposes a specific language by default.
The file begins with Chinese-only instructional text that defines the assistant role and behavior, but it does not offer the user any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
This markdown file describes an ETL that ingests order and member-related fields, including 会员ID, and produces an output dataset, but it does not include any warning or disclosure about handling potentially sensitive business or personal data. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or privacy.
Line L001 is written as a directive that defines the assistant as an ETL expert operating under these instructions, and the entire skill content is Chinese-only with no indication that users may choose another language. This creates a natural-language locale constraint without opt-in or justification as a region-specific requirement.
This README serves as the skill's primary documentation and all user-facing guidance is presented only in Chinese. Under the language/locale policy, forcing a single language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
The file explicitly recommends syncing RFM-derived customer labels and '营销策略' to a marketing system/CDP for automated outreach, but it provides no guardrails around consent, lawful basis, purpose limitation, minimization, or fairness review. In a membership/customer-data skill focused on identity unification and behavioral segmentation, this omission can directly enable privacy-invasive targeting and inappropriate automated profiling at production scale.
This is a markdown file, so SQP-2 applies to omissions in user-facing warnings. The document explains that results are written into daily reports and pushed to WeCom or Feishu groups via webhook, and later encourages granting broad read access, but it does not explicitly warn readers to review data scope, recipient groups, or privacy implications before enabling those notifications.
The file explicitly documents sensitive personal-data fields including 手机号, 生日, 性别, 年龄段, 城市, and activity/status attributes, which together enable direct identification and profiling of members. Even if the skill description says values are simulated, this file presents a realistic production-style schema, downstream lineage, and operational use cases without any privacy classification, masking guidance, access restrictions, or handling warnings, increasing the risk of misuse, overcollection, and accidental exposure.
The file documents a member identity bridge containing multiple persistent identifiers, including member ID, card number, hashed phone, OpenID, UnionID, enterprise contact ID, and payment-channel user ID, but provides no privacy classification, access restrictions, retention guidance, or handling warnings. In a membership/CRM identity-resolution context, aggregating these cross-channel identifiers materially increases re-identification and account-linkage risk even if some fields are hashed, because the schema itself enables OneID-style correlation across systems.
The file explicitly documents personal-data fields such as store manager and regional manager names in a broadly described skill artifact without any privacy warning, access restriction note, or handling guidance. Even if this is only schema metadata, exposing the presence and business use of identifiable personnel fields can enable unnecessary access, downstream misuse, or accidental propagation into analytics, exports, and prompts.