Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent competitor-analysis helper, but it may retain sensitive business context and use web/file tools without clear user controls.
Review this skill before installing if your competitor research includes confidential strategy, unreleased product plans, pricing, customer data, or internal documents. Use it with redacted inputs where possible, and avoid enabling persistent memory for sensitive business context unless you are comfortable with later reuse.
The trigger phrases are broad enough to match common requests like market research, comparisons, or learning about an industry, which can cause the skill to activate outside its intended scope. In practice this can route users into unnecessary web/file-capable workflows, increasing the chance of unintended data collection, persistence, or tool use without clear user expectation.
The skill has Read, Write, and WebSearch capabilities, yet it does not warn users that external searches and local report writing may involve sensitive input, generated files, or exposure of proprietary business context. Because the skill is designed for competitive analysis, users are especially likely to provide confidential product plans, target markets, or strategic notes that could be handled by tools without informed consent.
The skill explicitly says it will remember user industry, product positioning, prior competitors, and reporting preferences, but provides no notice about retention, scope, or user control. This creates a privacy risk because users may disclose sensitive business strategy or proprietary information without understanding that it may be stored or reused later.
All invocation examples and operating instructions are in Chinese, and the skill does not indicate that language is optional or region-specific. Under the language/locale policy, forcing a single language without user opt-in can be a natural-language policy concern unless the restriction is explicitly documented and justified.
No suspicious patterns detected.
