Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward industry-opportunity research writer that creates a markdown report and updates local pipeline state for the requested industry.
Before installing, expect the skill to perform web searches and to create or modify local files under output/{industry-slug}, including session.json. Review generated policy and market claims for source quality, especially when reports are sparse and the skill falls back to general knowledge.
The skill allows '独立召唤' as a use condition without defining strict trigger boundaries or requiring explicit user confirmation. In an agentic environment, vague activation criteria can cause the skill to run outside the intended pipeline and perform web lookups, file writes, and session mutation on loosely related prompts, creating unintended side effects.
The skill explicitly instructs the agent to create 04-opportunity.md and update session.json, but it does not require notifying the user that local files will be written or modified. This can lead to silent persistence and modification of workspace state, which is risky in agent systems because the user may expect analysis only, not filesystem changes.
The standalone mode says a minimal session.json will be auto-generated when missing, but it omits any warning or consent requirement for creating new local state. Auto-generating session files increases the risk of unexpected artifact creation, confusing provenance, and accidental contamination of a user's workspace or downstream pipeline.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown reference mandates a single language for the skill content without offering user opt-in or documenting a justified locale restriction, which can conflict with organizational language-choice expectations.
No suspicious patterns detected.
