Security audit
Security checks for vulnerabilities and agentic risk
This is a research-report workflow skill with a disclosed local Word-document output requirement and no evidence of hidden code, credential access, persistence, or exfiltration.
Before installing, expect this skill to guide research and produce a Word report. Ask the agent to confirm the output filename and location before it writes anything, especially if you do not want files placed on your Desktop.
The entire skill is written as a Chinese-only workflow and output convention, but it does not state that language is optional or user-selectable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern unless the regional constraint is explicitly justified.
The skill explicitly requires writing a .docx file to ~/Desktop/ as part of normal execution, but it does not require prior user consent or warn about filesystem side effects. This creates an unsafe default because an agent following the skill could modify the user's environment unexpectedly, overwrite existing files with similar names, or leave sensitive research artifacts on disk without the user's approval.
No suspicious patterns detected.
