Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese renovation-cost advice skill made of Markdown guidance files, with no code execution, persistence, credential access, or hidden data handling.
This skill is safe to install from a security standpoint, but users should treat its renovation and contractor advice as opinionated guidance, verify claims against contracts and local rules, and avoid relying on derogatory search terms as proof of wrongdoing.
The trigger list includes very broad terms such as “费用”, “值不值”, and “装修公司”, which are common phrases that can appear in many unrelated conversations. This can cause unintended skill activation, leading the agent to inject domain-specific guidance when the user did not explicitly request this skill, reducing reliability and potentially confusing users.
The skill explicitly advises users to search for companies using derogatory or accusatory terms such as '垃圾/黑/欺诈'. Even if intended as consumer due diligence, this encourages defamatory or inflammatory query construction and can amplify unverified allegations, creating reputational harm and policy risk. In this skill context, the advice is more dangerous because it is framed as a recommended evaluation method rather than a neutral warning to verify complaints from reliable sources.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all guidance only in Chinese and does not provide any user opt-in, alternative language option, or explicit justification that the skill is region- or language-specific.
