Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese industry-report generation skill that coherently uses web research and local report files without hidden persistence or destructive behavior.
Install this if you want Chinese-language industry analysis reports. Expect the agent to search the web, cite sources, read the bundled report template, and create an HTML or PDF report file in the working directory; for brief or casual questions, confirm whether you want the full report workflow.
The title and all template instructions are written exclusively in Chinese, which effectively constrains generated output to Chinese. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific compliance reason, so this appears to be a natural-language locale policy violation.
The file's natural-language guidance is exclusively in Chinese, including headings, rules, and examples, with no indication that users may choose another language or that the skill is limited to a Chinese-only workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The trigger description is broad enough to match many ordinary requests about whether an industry is 'good' or 'worth entering', which can cause the skill to activate in contexts the user did not explicitly intend. Because this skill performs web searches and generates local files, over-triggering increases the chance of surprising tool use, unnecessary data retrieval, and unintended file creation.
The workflow explicitly instructs the agent to perform web searches, read a local reference file, and generate HTML/PDF output, but the skill description does not warn users that external retrieval and local file creation will occur. This weakens informed consent and can lead to unexpected network access or artifact creation in environments where users may assume a normal text-only response.
No suspicious patterns detected.
