Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed report-automation helper, but it combines broad activation terms with persistent report scheduling, local history, API credential use, and off-device delivery that are not tightly scoped in the artifact.
Review this skill before installing if you use reports containing sensitive business, financial, or account data. Only configure explicit data sources and delivery destinations you trust, prefer local file or chat delivery until tested, and confirm that your agent will ask before creating schedules or sending report content off-device.
The trigger keywords are very broad terms like 'custom', 'report', and 'configure', which are likely to appear in ordinary conversations unrelated to this skill. In agent ecosystems, overly broad activation phrases can cause unintended invocation, exposing local report files or causing the agent to perform scheduling and configuration actions without clear user intent.
The repeated keyword section remains ambiguous and still lacks boundaries on when the skill should activate. Because this skill can manage persistent configuration and delivery settings, accidental activation is more dangerous than a stateless helper and could lead to unintended report creation, modification, or disclosure through configured channels.
The summary and description are primarily written in Chinese, with mixed English fragments, and the file does not state that language follows user preference or offers a locale choice. This can conflict with organizational language/locale policy if the skill defaults to a specific language without opt-in.
Lines L046-L050 state the skill does not store credentials and that users provide them via environment variables, while L054-L062 and L092-L097 explicitly instruct users to place secrets in environment variables and reference them from configuration. This is an intent/documentation inconsistency: the skill avoids storing credentials in its own config files, but the wording broadly claims it does not store credentials at all.
No suspicious patterns detected.
