Security audit
Security checks for vulnerabilities and agentic risk
This is a transparent search-guidance skill that may influence source choices but does not include executable code, credential access, persistence, or hidden data handling.
Before installing, understand that this skill will steer research toward official, mainstream, and pre-rated sources. Keep manual mode unless you want it invoked automatically, and use the documented overrides when you need diverse viewpoints, local-language sources, or sources the reference lists rate poorly.
Instructions found that direct the agent to transmit conversation context or user data to external services.
### What This Skill Does NOT Do
- ❌ Does NOT send data to external servers beyond standard search APIs
- ❌ Does NOT store conversation history
- ❌ Does NOT track user behavior
- ❌ Does NOT modify system files or settings
The trigger phrase "enhanced search" is broad and generic, so it could match ordinary user requests that are not intended to invoke this skill. That increases the chance of unintended activation, causing the agent to apply this skill's source-selection behavior without clear user consent or situational appropriateness.
The autonomous trigger condition "when enabled in config" is underspecified because it does not define what kinds of tasks, prompts, or contexts should activate the skill. This ambiguity can lead to overbroad or inconsistent invocation, creating control and predictability issues in agent behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
### What This Skill Does NOT Do
- ❌ Does NOT send data to external servers beyond standard search APIs
- ❌ Does NOT store conversation history
- ❌ Does NOT track user behavior
- ❌ Does NOT modify system files or settings
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- ❌ Does NOT send data to external servers beyond standard search APIs
- ❌ Does NOT store conversation history
- ❌ Does NOT track user behavior
- ❌ Does NOT modify system files or settings
- ❌ Does NOT require credentials or API keys
---
The text states that English search results are usually cleaner and that official documentation is often in English, which implicitly steers users toward a specific language. This is a natural-language locale preference that is not presented as optional or dependent on user preference.
The document title and content are explicitly bilingual with a strong Chinese-first framing (e.g. '常用中文媒体来源' and paired translations throughout), but it does not state that users may choose their preferred language or locale. Under the policy, natural-language constraints should offer user choice unless the locale restriction is clearly justified.
The document explicitly recommends English-language searching as a way to get 'cleaner results,' which biases the agent toward a specific language strategy without any user opt-in or task-based justification. In a search-guidance skill, this can systematically distort retrieval behavior, reduce relevance for users seeking Chinese or multilingual primary sources, and create unfair or incomplete outputs.
The file is presented as an English-titled reference document, but line L007 and many subsequent sections embed substantial Chinese text inline. Under the policy rule, forcing a specific language or mixed-language presentation without user opt-in can create a language/locale policy violation for users who expect a single accessible language.
The file presents example override commands exclusively in Chinese string literals, which imposes a locale-specific interaction pattern in natural language. Under the policy rule, this is a language/locale constraint without explicit user opt-in or a documented region-specific justification.
Natural-language policy review applies to all file types. The file presents both English and Chinese command phrases, but it does not state that language use is user-selectable or optional, which can create an implicit locale expectation without explicit opt-in.
The recommendation list heavily prescribes Chinese sources and also separates 'English authoritative' sources, but does not indicate that language or regional source selection is optional or context-dependent. This can be read as a default locale policy that excludes other languages/locales without user choice or an explicit region-specific justification.
The document instructs users to use "English keywords (for cleaner results)," which imposes a language preference in the workflow. Because the file does not present this as optional user choice or justify it as a clearly region-specific requirement, it conflicts with the policy against forcing a specific language without opt-in.
No suspicious patterns detected.