Security audit
Security checks for vulnerabilities and agentic risk
This skill is a bilingual conversational guide for building a Business Model Canvas and does not include code, persistence, credential access, or hidden actions.
Installers should expect a bilingual English/Chinese Business Model Canvas coach that asks structured business questions. Consider narrowing activation phrases or clarifying language preference if unwanted activation or bilingual output would be distracting.
The README is written as a fixed bilingual English/Chinese experience throughout, with no indication that users can choose their preferred language or locale. Under the language policy rule, presenting a forced language/locale format without opt-in can be a natural-language policy concern.
The description contains a very broad set of trigger phrases, including generic business, strategy, startup, and product terms in both English and Chinese. This can cause the skill to activate in many ordinary conversations beyond the user’s clear intent, leading to unsolicited steering of the interaction and increasing the chance that other safeguards or more appropriate skills are bypassed.
The README says only to 'Trigger this skill in OpenClaw' without specifying concrete trigger phrases, activation conditions, or exclusion cases. For a markdown file, this leaves the invocation scope ambiguous and could cause uncertainty or unintended activation in normal use.
The file consistently presents instructions and outputs in both English and Chinese, suggesting a fixed locale/language pattern. Under the language policy rule, forcing a specific language or locale without user choice can be a natural-language policy violation unless explicitly documented as region-specific or optional.
The natural-language description is explicitly bilingual, combining English and Chinese in a fixed way, but the manifest does not indicate that language selection is optional or that the skill is region-specific. Under the language/locale policy, hard-coded locale behavior without user opt-in can be a policy concern.
No suspicious patterns detected.
