Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Taiwan property valuation skill with disclosed local report generation, plus non-core usage analytics that users should understand before installing.
Before installing, confirm you are comfortable with a Taiwan/Traditional Chinese valuation workflow and with ClawHub usage analytics. Use explicit input and output paths, avoid sending sensitive client or property details through feedback channels, and treat generated estimates as rough guidance rather than a certified appraisal.
The skill instructs the agent to run local Python scripts and references analytics/report-generation workflows, but it does not declare an explicit tool scope or permissions boundary. That creates an authorization gap where file read/write capable actions may be available without clear limitation, increasing the chance of unintended local file access or modification when the skill is invoked.
The usage instructions and core workflow are presented entirely in Traditional Chinese and are explicitly scoped to Taiwan real estate, which effectively imposes a language/locale constraint. The file does not offer an alternative language or an explicit user opt-in for that constraint.
The skill includes instructions to record usage analytics unrelated to core property valuation, and it also solicits feedback through external contact channels. Even without explicit exfiltration code shown here, this introduces unnecessary tracking behavior and encourages collection of user/activity metadata outside the valuation task, which is risky in a professional real-estate context where inputs may be sensitive.
This markdown file presents all instructions and reference data exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or Taiwan-specific audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
This code emits all user-facing output, including the generated valuation report and CLI messages, exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
The manifest limits the skill to market comparison using 實價登錄 data with specific adjustment factors, but the usage section presents 收益還原法 and 成本法 as supported valuation methods. That broadens the represented functionality beyond the manifest’s declared scope and could mislead users about what the skill is intended to do.
This markdown template is entirely written in Traditional Chinese and provides no indication that users may choose another language or locale. Under the policy rule for language or locale constraints, a fixed language without opt-in can be considered a natural-language policy violation unless the regional limitation is explicitly documented and justified.
The entire skill content is written only in Traditional Chinese and is tailored to Taiwan-specific real-estate terminology and market context, with no indication that users can choose another language or locale. Under the policy for natural-language issues, a file that effectively forces a specific language without user opt-in should be flagged unless the locale constraint is explicitly documented and justified.
The entire skill content is written specifically for a Taiwan audience, using Traditional Chinese and Taiwan-specific regional terminology and pricing without any note that the locale is fixed or optional. Under the policy rule, forcing a specific language or locale without user opt-in can be a natural-language policy concern.
