Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Amazon product-research assistant that uses public web research and saves a local Markdown report, with no evidence of hidden execution, credential use, or exfiltration.
Install this if you want a Chinese-language Amazon/FBA research workflow and are comfortable with it making many public web queries and saving a Markdown report in the workspace. Avoid giving it private Seller Central data, API keys, or confidential supplier terms unless you are comfortable with those details being included in the saved report.
The skill description and operational instructions are written to operate in Chinese, and the interaction/output requirements do not offer the user a language or locale choice. This can violate language/locale policy because it effectively imposes a specific language without user opt-in or a documented region-specific justification.
The trigger list includes broad, natural-language phrases like “帮我看看这个品类”, “分析这个产品”, and “这个能不能做”, which are generic enough to match many unrelated conversations and cause accidental skill activation. In a tool that drives extensive web research and file output, overbroad activation increases the chance of unintended data collection, unnecessary external requests, and user confusion about why the skill took over.
The skill mandates writing a full report to a file and only afterwards telling the user the file path, without first obtaining consent or clearly disclosing that persistent local artifact creation will occur. Silent file creation can expose sensitive business inputs, scraped market data, or derived analysis to unintended retention, later access by other tools/users, and confusion about where data was stored.
The entire guidance is written in Chinese and includes Chinese-only community/search instructions, with no indication that users may choose another language or locale. This can violate a language/locale policy when a skill implicitly mandates a specific language without opt-in.
The document title and all required report content are written as a fixed Chinese template, and line L003 states the output must cover all listed sections, implying the skill output is constrained to Chinese. This is a natural-language policy concern because it enforces a specific language without offering user choice or documenting a justified locale restriction.
该文件全文以中文编写，且未说明这是面向中文用户的可选本地化版本，也未提供语言/locale 选择。按规则，强制单一语言而无用户 opt-in 可能构成自然语言层面的语言/地区策略问题。
This markdown file explicitly requires saving a complete report to disk and specifies a filename format, but it does not warn the user that a local file will be created or potentially overwrite an existing file with the same name. For markdown files, SQP-2 applies when behavior affecting user data or system state is described without a warning.
