Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent competitor price-monitoring helper with disclosed external API use, but users should treat pricing data shared with the provider as commercially sensitive.
Install only if you are comfortable sending relevant product, competitor, market, and pricing details to YunlvAI/TradeGPT services. Use the skill with non-confidential or approved business data, confirm alert recipients before enabling email or WhatsApp notifications, and consider narrowing activation if generic pricing-analysis prompts are common in your workflow.
The trigger phrase "价格分析" is broad enough to match many generic pricing-analysis requests that are not specifically about competitor monitoring or price-intelligence workflows. This can cause unintended skill activation, leading the agent to load external-data/API behavior and pricing-strategy guidance in contexts where a narrower finance, quoting, or analytics skill would be more appropriate.
The manifest advertises monitoring, analysis, and alerting capabilities backed by an external API, but it does not clearly disclose that user-provided pricing, competitor, or market data may be transmitted to api.yunlvai.com. In a B2B pricing context, such data can be commercially sensitive, so lack of disclosure and consent creates a meaningful confidentiality and compliance risk.
The trigger list contains very broad business phrases such as '价格分析', '市场价格', and 'competitive pricing' that are likely to match ordinary conversations, causing the skill to activate outside a narrowly intended context. Because this skill sends pricing-related content to an external API, overbroad activation increases the chance of unnecessary third-party transmission of sensitive commercial information.
This markdown file presents all guidance exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a reportable issue.
The English trigger "competitive pricing" is ambiguous because it commonly refers to general pricing strategy, not necessarily ongoing competitor-price monitoring. This ambiguity increases the chance of overbroad invocation and misrouting, which may expose unnecessary external API use or cause the agent to produce monitoring-oriented outputs that do not fit the user's request.
The manifest embeds Chinese and English invocation language, but it does not specify whether the skill is intended for bilingual use, locale-specific operation, or how language selection is handled. This is a weak but notable natural-language policy concern because language behavior is implied rather than explicitly offered as a user choice.
This markdown file is a natural-language template, and its instructions and placeholders are presented exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy violation when no justification or alternative is provided.
No suspicious patterns detected.
