Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed game-AI news collector that fetches public feeds and writes local news cache files, with no evidence of credential theft, destructive behavior, or hidden execution.
Install only if you want a Chinese-focused game-AI news workflow that fetches public RSS/API sources and stores local daily cache files. Avoid searching with confidential project names or private strategy terms, because live searches may be sent to third-party services. Treat generated reports as curated summaries and verify source links for important decisions.
The trigger conditions are intentionally broad and encourage invocation on short, ambiguous phrases, which can cause the skill to activate without clear user intent. Because the skill performs network fetching and data processing, over-triggering can leak user queries to third parties, consume resources, and override safer or more appropriate routing choices.
The trigger examples are intentionally broad and include very short phrases like “游戏 AI 最近有什么” and similar generic queries, which can cause the skill to activate when the user’s intent is ambiguous. In an agent environment, overbroad activation can route users into this skill unnecessarily, increasing the chance of irrelevant responses, hidden prompt influence, or bypass of more appropriate skills.
The skill instructs the agent to read/write local files and access external network resources, but it does not declare any explicit tool scope or permission boundary. This creates an authorization ambiguity where the runtime may grant broader capabilities than users expect, increasing the chance of unintended file access or outbound requests during skill execution.
The instruction '标题用中文' forces Chinese output formatting for titles, even though earlier text says the agent can use natural Chinese/English queries. This is a language policy concern because it imposes a specific language without explicit user opt-in or a documented locale-specific justification.
The skill describes automatic scheduled fetching and pushing results to users without indicating consent, opt-in, or a visible notification model. Unsolicited outbound activity and proactive delivery can violate user expectations and create privacy and trust issues, especially if the system infers interests from prior interactions.
The skill sends search terms directly to an external API but provides no user-facing warning that their query content will be shared with a third party. If users include sensitive business topics, project names, or internal research interests, this can disclose information outside the local environment without informed consent.
This JSON content contains titles and summaries entirely in Chinese, with no indication that language selection is optional or that the file is explicitly scoped to a Chinese-language or China-region audience. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.
The manifest describes a skill for '游戏行业 AI 资讯搜集' and says it should cover game-industry AI developments. However, entries such as the general LLM scaling post (L089-L102), LLM-agent memory research (L105-L117), and MiniMax's broad '10x Team' plan (L120-L131) are not themselves clearly game-industry news; they are only loosely connected through recommendations. This suggests the actual curated content is broader than the declared scope.
The dataset claims to provide game-industry AI news, but multiple included entries are general AI/agent infrastructure or film-industry commentary rather than clearly game-specific content. This creates a scope-integrity problem: downstream consumers may trust the feed as domain-filtered and make decisions or summaries based on irrelevant or misleading items.
The content in this range includes general AI industry news (for example, NVIDIA CPU shipments to major AI labs) that does not clearly relate to the stated game-industry AI scope. In a news-selection skill, off-scope data can cause mis-triggered or misleading outputs, weaken user trust, and create an integrity problem where the skill presents unrelated material as domain-specific intelligence.
The natural-language description is written as a mandatory behavior statement in Chinese and provides no option for users to select language or locale. Under the stated policy, forcing a specific language without opt-in can be a locale/language policy violation when no justification is documented.
This JSON manifest includes fixed Chinese query terms such as "游戏" and sets the source region to "cn", which indicates a locale/language preference embedded in configuration. Under the policy, forcing a specific language or locale without an explicit user choice or justification can be a natural-language policy violation.
This Python file contains natural-language descriptions and user-facing status messages entirely in Chinese, beginning with the module docstring and continuing throughout execution. Under the policy, forcing a specific language without user opt-in is a violation unless the locale constraint is explicitly documented and justified; this file provides no such opt-in or justification.
The module docstring and multiple user-facing messages describe and present the skill entirely in Chinese, indicating an implicit fixed-language behavior. Under the policy, forcing a specific language without user opt-in or a documented justified locale scope is a natural-language policy violation.
All user-facing instructions and invocation examples in the README are presented only in Chinese, with no indication that other languages are supported or that the skill is intentionally limited to Chinese-speaking users. This can be a language/locale policy concern when users are not given an explicit language choice or opt-in.
The file earlier mandates '不使用任何 emoji' and repeats that no emoji should be used in user output, but the '发群简报格式' example includes a leading 🎮 emoji. This is an active contradiction in the skill's own instructions that can cause the agent to produce output that violates the stated formatting intent.
This manifest-style JSON contains user-facing natural-language fields in multiple languages, such as Chinese at L015 and English elsewhere, but does not indicate any user opt-in or locale selection policy. That can violate a language/locale policy if consumers expect a consistent language unless the skill explicitly documents multilingual behavior.
The inline note says '建议追溯原始来源后再展示', which expresses an intent not to present such items directly before source verification. Yet the same records remain in the output dataset with title, summary, and recommendation fields like regular items, indicating the documented intent is not being enforced by the produced content.
This JSON file contains user-facing titles, summaries, and recommendations in both Chinese and English across multiple items, but provides no indication that the user can choose a preferred language or locale. Under the stated policy, forcing a specific language or locale without opt-in can be a violation, and this dataset appears to present mixed-language content by default.
This JSON dataset contains multiple entries in different languages, including Chinese and English titles and summaries, but nowhere indicates whether multilingual output is intentional, configurable, or limited to a specific audience. That can violate a language/locale policy when a skill or its data implicitly forces mixed-language behavior without user opt-in or documented justification.
Some recommendation labels frame non-game articles as game-industry AI developments, which can mislead users about the significance or applicability of the linked content. In a news-curation skill, these labels act as trust-amplifying metadata, so inaccurate framing can bias decisions, reporting, or automated ranking.
This JSON appears to be a manifest/data file, but it contains no information describing when the skill should activate, what phrases should trigger it, or any exclusions. For manifest-style files, missing trigger specificity can lead to ambiguous invocation behavior if this file is used as part of skill routing or selection.
The document declares lang="zh-CN", and all visible UI/content is presented only in Simplified Chinese. This creates a natural-language locale constraint without offering the user an alternative language or documenting why the page must be China-specific.
