Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed local demo for competitor price monitoring, with no hidden execution, exfiltration, or persistence found.
Install only if you want a Chinese-language local demo/workflow for competitor price tracking. Treat its monitoring output as simulated unless you replace the collector, and review any future real scraping, Feishu notification, cookie, proxy, or platform-access setup for legality, terms of service, and recipient scope.
描述与代码部分匹配：确实涉及竞品价格监控、阈值预警、促销价字段、评价相关基础指标、以及报告生成功能。但存在明显能力落差。代码的核心行为是本地 CLI + SQLite 的模拟监控系统，并不进行真实竞品站点抓取，也不提供持续实时监控；所谓“上新动态”完全未实现；“评价口碑分析”仅保存 rating 和 review_count，没有任何文本评论抓取、情感分析或关键词提取；“促销活动检测”也只是展示 promo_price，而非检测促销动作。由于声明包含多个核心能力，而代码只实现其中一部分且部分还是模拟实现，因此应判定为描述与实际行为不完全一致，存在实质性 mismatch。
Without declared permissions the skill's intent is opaque and cannot be validated.
This markdown file contains only Chinese-language instructions and framework content, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown file presents all operational guidance exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
This code file contains natural-language instructions and output text that force a specific language/locale for users. Under the policy, a skill should not impose a language without user opt-in unless the locale constraint is clearly documented and justified.
The manifest frames this skill as a real-time competitor intelligence monitor, and the CLI help says '立即检查所有竞品（模拟采集）'. The actual check path calls simulate_fetch, which fabricates monitoring data locally rather than collecting live competitor information, so the behavior does not fully match the claimed monitoring function.
The manifest describes capabilities including 评价口碑分析（好评/差评关键词） and 上新动态追踪, implying collection and analysis of review text and new-product events. In the implementation, data collection is limited to simulated numeric fields (price, promo_price, review_count, rating), and downstream logic only records/report price changes; there is no code for review keyword analysis or new-product detection.
This markdown file presents the skill content entirely in Chinese beginning with the title on L01, and nowhere in the document offers an alternative language or indicates that the language requirement is optional. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.
No suspicious patterns detected.
