Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently generates Chinese industrial-park investment reports and does not show hidden execution, exfiltration, privilege escalation, or destructive behavior.
Before installing, confirm you are comfortable with the skill creating HTML report files in the session reports folder and loading Chart.js from a CDN when the report is opened. Review generated business and招商 recommendations before sharing, especially if they include non-public strategy or enterprise targeting data.
The manifest description is entirely in Chinese and defines the skill as generating a report for leadership consumption, but it does not state that Chinese is optional or that the skill is limited to a Chinese-language/regional use case. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill directs the agent to generate and version HTML files under a session path without clearly warning the user that persistent artifacts will be created. In this context, the danger is limited but real: users may unknowingly leave behind multiple report files containing potentially sensitive business analysis, which can increase accidental disclosure or storage sprawl.
No suspicious patterns detected.
