Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent AI monetization planning helper, with disclosed browsing and report-writing behavior but some scoping and language clarity users should notice.
Install only if you want a Chinese-language AI monetization research workflow. Before letting it run, confirm when it should browse, run analysis commands, or create report files, and choose a specific output location to avoid surprise files.
The natural-language instructions and examples are entirely in Chinese, and the skill does not state that language is selectable or that Chinese is required for a specific regional purpose. This can violate language/locale policy when the skill implicitly constrains interaction language without user opt-in.
The listed trigger phrases are broad, ordinary user requests such as asking how to make money with AI, which can cause the skill to activate in situations where the user did not explicitly request this specific capability. Over-broad invocation increases the chance of unwanted browsing, report generation, or tool use, especially because the skill can access browser, exec, and file write capabilities.
The instruction to proactively use the skill whenever users say broad phrases like '如何用 AI 赚钱' encourages automatic activation without clear user consent or disambiguation. In context, this is more dangerous because the skill is empowered to browse external sites and write files, so unintended invocation can expand into unintended actions.
The skill advertises read/write access for report generation but does not warn users that local files may be created or modified. This can lead to surprising data changes or overwriting of existing files if the agent generates reports automatically as part of the workflow.
No suspicious patterns detected.
