Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-language domain valuation helper with a local analysis script and no evidence of hidden data access, persistence, or destructive behavior.
Install this if you want Chinese-language domain value analysis. Be aware it may activate on broad domain-related phrasing and it declares WebFetch/Bash, so users should confirm before allowing web checks or command execution; treat its valuation output as rough guidance, not financial or legal advice.
The file presents all operating instructions and recommendations in Chinese, but does not state that the skill is intended only for Chinese-speaking users or provide an opt-in language choice. That can conflict with language/locale policy requirements when a skill effectively forces a language for interaction without user selection.
The README states that merely mentioning a domain in normal conversation can trigger the skill, which creates an overly broad activation surface. In an agent environment, this can cause unintended invocation on incidental user text, leading to unsolicited analysis, workflow interference, or accidental use of tools when the user did not explicitly request the skill.
The skill content is written to operate in Chinese and effectively steers output language without checking the user's preferred language. While not a direct code-execution issue, it can override user expectations, degrade transparency, and create opportunities for misleading or less reviewable responses in multilingual environments.
The activation examples are ambiguous and lack boundaries, so many benign mentions of domains, TLDs, or registration could match even when the user did not ask for this specialized analysis. In context, this is more concerning because misrouting into a skill with external tool permissions can expand attack surface and lead to unnecessary command or web activity.
The trigger conditions are broad enough that ordinary domain-related conversation could activate the skill without clear user intent to request a valuation workflow. This can cause inappropriate tool-enabled routing, surprise behavior, and reduced reliability, especially because the skill has access to WebFetch and Bash.
The script's report text, usage examples, and final recommendations are presented exclusively in Chinese. This is a natural-language locale constraint with no user opt-in, alternative language path, or documentation that the tool is intended only for a Chinese-speaking or region-specific context.
The package description is written entirely in Chinese, which implies the skill is intended to operate in a specific language without indicating any user choice or opt-in. Under the language/locale policy rule, this is a natural-language constraint that should be explicitly optional or justified.
No suspicious patterns detected.
