Security audit
Security checks for vulnerabilities and agentic risk
The skill is purpose-aligned but asks users to collect internal business and messaging data, stores it locally, and can generate reports with hard-coded figures without adequate controls.
Review before installing. Use this only with authorization to access the IMRC pages and Meixin messages involved, and avoid feeding it personal or confidential communications unless retention and redaction rules are clear. Treat generated KPI and personnel/project statements as untrusted until the hard-coded report values are replaced with validated calculations from source data.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
name: imrc-report
description: "Generate monthly/annual operations reports from IMRC system data across 10 pages"
tags: [analysis, data, visual, file-based, template-based]
The README explicitly instructs users to extract IMRC system data and collect Meixin messages, but it provides no warning, consent guidance, data-classification notes, or handling requirements for potentially sensitive operational and personal communications. In a reporting workflow, this omission can lead operators to collect, store, and process internal business data or employee messages in ways that violate privacy, confidentiality, or compliance expectations.
The trigger phrases are broad, overlapping, and ambiguous, which can cause the skill to activate in contexts where the user did not clearly intend to run this reporting workflow. Because the skill handles internal operational and messaging data, accidental invocation increases the chance of unnecessary access, collection, or disclosure of sensitive enterprise information.
The skill explicitly instructs collection of internal messaging content ('美信消息') but provides no warning, consent boundary, minimization rule, or handling guidance for potentially sensitive personal or business information. In an enterprise setting, this can lead to over-collection of employee communications, inclusion of confidential content in reports, and privacy or compliance violations.
The entire report template is written exclusively in Chinese, including headings, labels, and narrative sections, which imposes a specific language/locale on generated output. Under the policy, a fixed language is a violation when the skill does not offer the user a language choice or document a justified locale-specific constraint.
The module docstring states that it extracts operational data from 10 IMRC pages and supports browser automation and API extraction. However, the core extraction function explicitly labels itself as simulated extraction and returns empty placeholder data instead of actually retrieving page content, which contradicts the documented behavior.
The script writes collected internal messaging data to a persistent JSON file under a workspace memory directory without any consent flow, minimization, retention control, access restriction, or warning that the data may contain sensitive communications. In the context of a message-collection tool intended for operational reporting, this creates a real privacy and data-handling risk because internal chat content can include personal, confidential, or business-sensitive information that may be retained longer than necessary or exposed to other processes/users on the host.
This Python file is a code file, so SQP-3 applies. The script's purpose, report content, CLI description, warnings, and status messages are all hard-coded in Chinese, and there is no option for the user to select another language or any documented justification that the skill is intentionally region- or locale-specific.
The function is presented as generating a report from loaded IMRC and Meixin data, but the summary body is largely hard-coded and does not derive the displayed KPI values from the input datasets. In a reporting skill, this creates an integrity risk: operators may trust fabricated or stale business figures as if they were data-backed, leading to incorrect decisions or concealment of real operational issues.
This markdown template is entirely written in Chinese, including headings and field labels, which implies the skill will produce output in a specific language by default. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, neither of which appears in this file.
This JSON configuration defines all user-facing page names in Chinese only, with no indication that users can choose a language or locale. Under the policy for natural-language violations, a forced locale without opt-in can be flagged unless it is clearly documented as region-specific or justified.
The natural-language strings and documentation describe the skill entirely in Chinese and present its operation as fixed to that locale, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is explicitly justified.
This code file contains user-facing natural-language strings such as the module docstring and console output entirely in Chinese. Under the policy rule for language/locale, forcing a single language without user opt-in or a documented justification is a natural-language policy violation.
This markdown template presents all headings and labels exclusively in Chinese, which can enforce a specific language on users without any visible opt-in or alternative locale handling. The policy requires flagging language or locale constraints when they are imposed without user choice or documented justification.
This markdown template presents all user-facing content exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is limited to a Chinese-language context. Under the policy criteria, forcing a specific language without user choice can be a natural-language policy violation.
The template content and headings are entirely in Chinese, including the report title and presenter/date labels. Because SQP-3 applies to all file types and flags language-policy issues when a skill forces a specific language without user opt-in, this appears to impose a fixed locale with no visible alternative or justification in the file.