Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed business data analysis and charting prompt with some broad trigger wording, but no hidden code, persistence, credential use, or destructive behavior.
Install this if you want a persistent assistant behavior for business KPI analysis and dashboard-style visualization. Be aware that broad phrases like analyze this data or visualize this may invoke it more often than expected, and rendered charts may load Chart.js from a public CDN.
The documented trigger phrases are very broad and map to common business-language requests such as '帮我分析' and '综合分析'. In an agent platform, this can cause accidental invocation or skill-selection collisions, leading the skill to activate on ordinary conversations and process data the user did not intend to route here.
The top-level skill description is broad enough to activate on many ordinary requests involving analysis, screenshots, tables, or visualization, without strong gating criteria. This can cause the skill to intercept prompts outside its intended scope, leading to misrouting, unintended tool usage, or application of high-authority instructions to benign user tasks.
The listed trigger phrases include common, ambiguous requests such as 'analyze this data' and 'visualize this', which are likely to match routine user intents far beyond the specialized role described by the skill. Because the skill also imposes strict workflow and tool-use behavior, over-triggering increases the risk of inappropriate takeover of conversations and unnecessary execution of visualization-oriented instructions.
The README's user-facing description and invocation guidance are written exclusively in Chinese, which can amount to a language policy issue when no alternative language option or opt-in is offered. The file does not indicate that the skill is intentionally region-specific or that users may choose another language.
No suspicious patterns detected.
