Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent China-economy analysis workflow that uses public financial data and a scoped local archive, with no code execution or hidden behavior found.
Install only if you want a Chinese-language China-economy tracking workflow that will browse public financial sources and keep dated local snapshots for comparison. Do not include confidential research notes or private business context in prompts unless you are comfortable with that context being reflected in the local archive.
The trigger phrases include very generic language such as '用框架分析一下' and broad '跟进' phrasing that can easily match ordinary requests about news or the economy. This can cause unintended activation of the skill, leading the agent to browse external sites and perform persistent archival without the user explicitly asking for this specific workflow.
The description and operating instructions are entirely framed as a Chinese-only workflow for analysis and output, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern unless the constraint is explicitly justified.
The skill instructs the agent to write analysis results into memory/econ-tracker/YYYY-MM-DD.md, but does not require any user notice or consent for persistent retention. Even if the content is mainly economic analysis, stored results may include user prompts, proprietary research context, or derived preferences, creating unnecessary retention and cross-session data exposure.
The skill mandates browser collection from external financial news sources but gives no warning that network requests will be made to third-party sites. This can surprise users, leak metadata such as access patterns or session context, and create compliance issues in restricted environments.
