Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese-first AI career-roadmap assistant that uses user-provided career information and current web research to create a report, with no evidence of hidden execution, exfiltration, or persistence.
Install this if you want a Chinese-oriented AI career and learning-roadmap workflow. Before using it, remove unnecessary phone numbers, addresses, IDs, salary details, and confidential employer information from your resume, and explicitly specify your target region, language, plan length, and whether files may be saved.
声明描述的是一个面向终端用户的职业报告与学习路线生成技能，核心能力应包括解析用户背景、分析AI职业机会并产出个性化内容。实际代码是一个离线验证脚本：输入为现有报告文件路径，输出为格式与内容完整性检查结果。它通过正则和关键词检查报告是否包含指定章节、学习计划分层、日期、链接、周数、每周小时数等，还检测模板占位符和编码问题。代码没有任何简历解析、问答流程、职业匹配、学习路线生成、外部证据抓取或内容生成逻辑。因此其主要用途与声明存在实质性不一致。
Without declared permissions the skill's intent is opaque and cannot be validated.
The markdown states that Chinese users should preferentially receive the latest official Chinese documentation and Chinese videos. This imposes a language/locale policy based on the user's presumed identity rather than an explicit per-run language choice, which can violate language preference requirements.
The skill metadata and prompt are written only in Chinese and do not offer a language-selection mechanism, which can cause outputs, consent flows, and career recommendations to be presented in a language the user may not understand. In a skill that may process sensitive resume data and produce consequential career guidance, language mismatch can undermine informed consent and increase the chance of user misunderstanding.
The default prompt auto-invokes broad actions such as analyzing a resume, researching the latest AI job opportunities, and generating a tailored report without clear user-confirmation boundaries or scoped activation conditions. This can cause the skill to run in situations where the user did not explicitly consent to resume processing or external-market analysis, increasing the risk of over-collection, unintended data use, and misleading autonomous behavior.
This markdown file presents the skill content in a single forced language, which can violate language/locale policy when no user opt-in or alternative is provided. Nothing in the file indicates that Chinese is required for a region-specific purpose or that users may choose another language.
This markdown template presents all user-facing headings and fields in Chinese only, which imposes a specific language on users without any indication of opt-in or alternative locale support. Under the policy rule for natural-language violations, forcing a language without user choice is reportable unless the locale restriction is clearly justified.
This file presents all user-facing instructions and prompts exclusively in Chinese, which can amount to a language/locale policy violation when no opt-in or alternative language path is provided. The document does not state that the skill is intended only for Chinese-speaking users or a region-specific context.
This markdown file presents all instructions and taxonomy content exclusively in Chinese, which effectively forces a specific language for users consuming the skill guidance. The policy only permits this when the skill offers language choice or clearly documents a justified region- or locale-specific constraint, neither of which appears here.
The module description and subsequent validation rules are written to require a Chinese-format career report, and the validator later checks for multiple Chinese section names and phrases as mandatory content. This effectively forces a specific language/locale behavior without offering a language choice or documenting a justified region-specific constraint.
The CONCEPT_GROUPS and LAYER_GROUPS definitions make Chinese headings such as “执行摘要”, “个人画像”, and “通用知识” part of the required validation criteria, with only partial English synonyms. This imposes a specific language/locale expectation on users rather than allowing language selection or clearly limiting the tool to a region-specific workflow.
