Security audit
Security checks for vulnerabilities and agentic risk
This report-tracking skill is not malicious, but it can automatically retain report content and alter financial tracking records from broadly defined file or link analysis requests.
Review before installing. Use this skill only where automatic report archiving and updates to investment tracking files are acceptable, and instruct the agent to ask before writing or revising forecasts when handling sensitive reports or ambiguous file/link analysis requests.
The trigger conditions are extremely broad, covering generic mentions of files, links, text extraction, and analysis requests. This can cause the skill to activate outside the user's clear intent and then perform downstream actions like stock-pool association and persistent archival on unrelated content, creating authorization and data-handling risks.
The skill mandates appending to archive files, maintaining summaries, and moving older records into archive paths without requiring explicit user consent or warning about persistent retention. If triggered on sensitive or mistaken inputs, it can silently create durable records containing extracted report content and derived assessments, increasing privacy, compliance, and integrity risks.
This markdown template mandates Chinese-language headings, field labels, and standard output text throughout the file. Under the policy, forcing a specific language without offering the user a choice can be a natural-language locale violation.
No suspicious patterns detected.
