Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed customs-data lead-mining and outreach assistant, with some broad triggers users should watch for but no evidence of hidden or malicious behavior.
Install only if you intend to use Yunlv AI for customs-data-based B2B prospecting. Be aware that broad business prompts may invoke the skill, and confirm before sending queries or outreach through email, WhatsApp, or LinkedIn.
The trigger phrase "竞品分析" is broad enough to match general business or marketing conversations that are not specifically about customs-data mining. Because this skill performs sensitive lead-mining and outreach workflows, accidental invocation could expose user context to a higher-risk capability than intended and cause inappropriate data collection or prospecting suggestions.
The phrase "采购记录" is highly generic and can appear in ordinary procurement, ERP, finance, or internal purchasing discussions unrelated to customs records. In this skill's context, overbroad activation is more dangerous because it can route benign enterprise conversations into a competitor-customer mining and outreach workflow that handles sensitive commercial intelligence.
The manifest description is written with broad activation criteria such as general market intelligence, competitor customer mining, and product-buyer discovery, which can cause the skill to trigger on ordinary business-research requests outside a narrowly scoped customs-data intent. Over-broad invocation increases the chance that user queries are routed to a third-party data service unnecessarily, creating unintended data exposure and tool overreach.
The trigger list contains ambiguous business phrases such as 竞品分析, 贸易情报, customs data, and trade intelligence that overlap with common sales, research, and strategy requests. This can cause accidental invocation on broadly phrased user prompts, leading to unnecessary API calls to an external provider and possible disclosure of user intent or query contents to that provider.
The file presents all instructions and scoring guidance exclusively in Chinese, which can impose a fixed language on users without opt-in. The policy specifically calls for flagging language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation.
This markdown file contains user-facing operational guidance only in Chinese, and there is no accompanying note that the language is optional or intended for a specific locale. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown file is a natural-language template library, and it presents the skill in Chinese while prescribing English outreach templates throughout. Because the file does not tell the user they can choose the output language or that the templates are intentionally English-only for a specific market, it risks forcing a locale without explicit opt-in.
No suspicious patterns detected.
