Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only Chinese-language skill for reviewing flight product requirement documents, with no executable code, persistence, credential use, or hidden data transfer.
Before installing, users should know this skill is primarily intended for Chinese-language flight product requirement reviews and may activate on broad Chinese phrases for requirement review; use explicit flight-PRD context when invoking it.
The trigger phrases are broad and overlap with ordinary user requests such as '评审需求' or '给需求打分', which can cause the skill to activate in contexts the user did not intend. Misrouting a conversation to this skill can lead to unintended document ingestion and analysis, creating privacy, UX, and workflow integrity risks even if no direct code execution occurs.
The skill is described entirely in Chinese and does not state any language negotiation or fallback behavior, which can cause users to receive output in an unexpected language. In security-sensitive or compliance-related review workflows, language mismatch can cause misunderstandings, missed warnings, or incorrect acceptance of recommendations.
The display name, description, and default prompt are all written exclusively in Chinese, which implies a fixed language experience without any documented user opt-in or locale justification. This can violate language/locale policy when the skill does not explicitly offer a language choice or explain that it is intended only for a Chinese-language context.
The manifest's default prompt says to use "$flight-requirement-review" to review a flight requirement document, but it does not define when this skill should or should not be invoked, nor provide any negative examples or scope constraints. In a manifest file, this kind of natural-language invocation guidance is ambiguous enough to risk unintended activation for loosely related review requests.
The entire skill file is written as a Chinese-only review example and does not indicate that language choice is optional or user-selected. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The file title and all user-facing guidance are written entirely in Chinese, which effectively fixes the skill's operating language without any stated opt-in or alternative locale. The policy for this audit flags language or locale constraints when they are imposed without giving the user a choice or documenting a justified regional limitation.
This markdown template appears to prescribe a single language/locale for the skill content by presenting all instructions and field guidance only in Chinese. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
