Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed public-sentiment reporting workflow that searches public web sources and writes a local HTML report, with no bundled code, installs, persistence, or private-data access.
Installers should understand that this skill will search public web content and save an HTML report when used. For ambiguous requests, confirm the target, time range, and whether the user wants a generated report before invoking it; adjust the report language if the user does not want Chinese-locale HTML defaults.
The manifest advertises trigger keywords such as "sentiment," "public opinion," and especially "reputation," which are broad phrases that can appear in many general-purpose user requests. Although examples are provided, the file does not clearly constrain activation boundaries or provide exclusion conditions, increasing the risk of unintended invocation.
The activation criteria are broad enough to match generic requests about public opinion, reputation, or media coverage without requiring explicit user intent to perform web collection and create an HTML report. This can cause unintended tool use, scope creep, and collection/processing of third-party content when the user may have wanted only a brief discussion or advice.
The HTML template hard-codes lang="zh-CN" and Chinese-oriented font choices, which imposes a specific locale regardless of the user's language preference. The file does not offer a language choice or justify the locale restriction as region-specific behavior.
No suspicious patterns detected.
