Security audit
Security checks for vulnerabilities and agentic risk
This is a China-focused toy sourcing reference skill that reads its bundled data and does not show hidden access, network activity, credential use, or persistence.
Install this if you want a static, China-specific toy industry sourcing reference. Treat the market figures and supplier examples as reference data to verify before business decisions, but the artifacts do not indicate unusual security risk.
The skill is invocable and references code in do.py that can read files, but the manifest does not declare any permissions or allowed-tools scope. That creates an authorization ambiguity: the runtime may grant broader file-read capability than a reviewer or caller expects, which increases the risk of unintended local file access if the implementation changes or is misused.
The dataset is explicitly framed as "China Toys Industry Overview (2026)" and includes Chinese-language source naming, which imposes a China-specific locale/context. In a skill setting, this can be a natural-language locale policy issue when no user choice or justification is provided in the file itself.
