Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese career guidance skill with static reference material and a simple recommender script; no hidden data access, persistence, or destructive behavior was found.
Install this if you want Chinese-language career and vocational-education guidance from static local material. Treat salary, policy, certificate, and job-market details as reference-only and verify with official sources; do not provide real API keys unless you separately add and trust an external commercial integration.
描述覆盖的是一个较全面的职业教育与职业发展助手，但代码只包含静态职业数据库及若干查询/推荐函数，核心能力是按兴趣、学历、类别推荐职业，以及查看职业详情。它没有证书考试、政策解读、实习就业指导等主要宣称功能，也没有任何知识库检索或API扩展实现。因此代码行为仅对应描述中的一小部分，属于功能范围明显缩窄的描述-行为不一致。未发现额外敏感资源访问或隐藏权限使用，问题主要是宣称过宽、实际能力更窄。
An overly broad trigger can cause the skill to activate in ordinary career or job conversations where it may not be appropriate, increasing the chance of unwanted routing, irrelevant advice, or accidental invocation of external API-backed behavior if later enabled. In a career-guidance context, this is not inherently high risk, but it can still degrade trust and lead to privacy or consent issues if users did not intend to engage this specialized skill.
The natural-language description and examples are entirely in Chinese, and the file does not state that users may choose another language. This can amount to a language-policy issue if the skill implicitly forces one language without user opt-in.
The entire document is written exclusively in Chinese and provides no indication that language selection is optional or that the content is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown file presents all user-facing content exclusively in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
SQP-3 applies to all file types and includes language or locale policy violations. This markdown file presents all user-facing content only in Chinese and does not provide any opt-in, alternative language option, or explanation that the skill is intentionally limited to Chinese-speaking users or a China-specific audience.
This code file contains user-facing natural language in Chinese from the module description onward, and all CLI prompts and outputs are also Chinese-only. Under the language/locale policy rule, forcing a specific language without user choice can be a policy violation when no opt-in or documented locale constraint is present.
No suspicious patterns detected.
