Security audit
Security checks for vulnerabilities and agentic risk
This is a business-research skill that writes a scoped markdown report and session status file, with no executable code or hidden privileged behavior found.
Install if you want an agent to research public company rankings and generate a markdown report. Review the chosen output directory and remember that industry names, scope, and related search terms may be sent to external web services during research.
The skill explicitly instructs writing output/{industry-slug}/01-top-enterprise.md and updating session.json, but it does not require user awareness or consent before modifying local files. This creates a real integrity risk because an agent could overwrite or alter workspace data unexpectedly, especially when users provide a path and ask for partial reruns or补查 operations.
The workflow directs the agent to perform web_search and webfetch against external sites without any privacy or network-use warning. Even though the use case is business research, this can still leak user-supplied industry focus, scope, or sensitive project context to third parties and cause unintended outbound requests.
The heading and instructions are written in Chinese and state this is the standard structure every skill output should follow, which implies a fixed output language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified.
No suspicious patterns detected.
