Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrow China tools sourcing reference that reads its bundled dataset and exposes lookup helpers without network access, persistence, credentials, or destructive behavior.
Before installing, treat the sourcing data as static reference material and verify business-critical supplier, certification, and market claims independently. The main improvement would be clearer manifest permissions documenting that the skill only needs to read its bundled data.json file.
The skill is marked invocable and references implementation in do.py, while the manifest does not declare any tool scope or permissions despite static analysis detecting file-read capability. Missing explicit scope weakens least-privilege controls and can cause reviewers or runtime policy layers to misunderstand what the skill can access.
The natural-language description presents the skill as exclusively focused on China's manufacturing landscape and does not indicate that this locale restriction is optional or user-selectable. Under the policy rule for language/locale constraints, a fixed regional scope should either offer user choice or clearly document why the locale limitation is required.
This JSON file includes locale-specific natural-language content and Chinese script in the source field, but provides no indication that the language/locale is intentional, user-selected, or constrained to a region-specific use case. Under the policy rule for language or locale violations, forcing or assuming a locale without opt-in can be problematic when not clearly documented.
