Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Taiwan property valuation helper, with a disclosed but under-described usage analytics step users should treat as optional.
Before installing, understand that this skill is tailored to Taiwan property valuation and outputs Traditional Chinese reports. Use only intended input and output paths, and treat the analytics command as optional unless you are comfortable with local usage logging. Valuation outputs are estimates and should not replace a licensed appraisal for high-stakes decisions.
The skill asks the agent to run local Python scripts and also references analytics logging, but it does not declare any explicit tool scope or permissions. This creates ambiguity about what filesystem access is expected, increasing the chance an agent will perform unintended file reads or writes beyond the minimum needed for valuation tasks.
This code file contains user-facing natural-language content exclusively in Traditional Chinese, including the sample input values and the generated report text. The skill does not offer any language/locale selection or explain that it is intentionally limited to a Taiwan-specific audience, which violates the policy against forcing a specific language without user opt-in.
The file consistently uses Chinese instructions and Taiwan-specific terminology, which effectively forces a specific language/locale for users. While the Taiwan market focus is clear, the document does not explicitly tell users that the skill is intended only for Chinese-speaking or Taiwan-specific use, nor does it offer an alternative language option.
The documentation instructs users or agents to execute a separate analytics script to record usage, which is unrelated to performing a property valuation. Even if benign, this introduces unnecessary side effects, potential telemetry, and extra code execution that expands the attack surface beyond the skill's stated purpose.
The manifest positions this skill as a professional property valuation tool, but the file also embeds external contact and feedback mechanisms such as email, Line, and promotional instructions. Those capabilities are not necessary to estimate market value, compare properties, or prepare valuation reports.
This markdown file is entirely presented in Traditional Chinese, and there is no indication that the user can select another language or that the skill is intentionally limited to a Chinese-speaking locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This file contains only Traditional Chinese content and does not state that the skill is Taiwan- or Chinese-language specific, nor does it offer a language choice. Under the language/locale policy, forcing a single language without user opt-in can be a natural-language policy concern.
The entire skill is written only in Traditional Chinese and is specifically framed around Taiwan property valuation conventions, with no indication that users can choose another language or locale. Under the policy, forcing a specific language/locale without explicit opt-in can be a natural-language policy violation.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all content exclusively in Chinese and does not indicate user opt-in, alternative language availability, or an explicit justification that the document is restricted to a Taiwan-specific audience.
No suspicious patterns detected.
