Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed event ROI evaluation assistant with web research and scoring instructions that fit its stated purpose.
Before installing, expect this skill to guide the agent to search the web for event reputation and competitor context, then produce Chinese-style event ROI reports. Ask for your preferred language and confirm before running pre-event research if event names or plans are sensitive.
The README is written entirely in Chinese and presents the skill’s inputs, outputs, and usage examples only in Chinese, with no indication that users may choose another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The skill directly instructs the agent in Chinese without checking the user's language preference, which can override the user's expected interaction language and reduce usability or clarity. While not a classic security flaw, forced language behavior can cause miscommunication, mistaken approvals, or user confusion in workflows involving business analysis and recommendations.
The pre-event trigger condition is loosely defined as any user input indicating they 'plan to attend an event,' which can match a wide range of ordinary conversation and cause the skill to activate unexpectedly. This can lead to unintended web searches, incorrect mode selection, and confusing or privacy-impacting behavior if user intent was not to initiate event due diligence.
No suspicious patterns detected.
