Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Chinese government-procurement document review skill with no executable code, hidden persistence, or unrelated data access.
Install only if you need Chinese government-procurement document review. Verify important legal conclusions against current official sources or a qualified professional, especially for engineering projects that may overlap with bidding-law rules.
The display name, description, role, and operating instructions are all written exclusively in Chinese and direct the assistant to respond in that language/style. This is a natural-language locale constraint, and the file does not offer any user opt-in or alternative language choice, nor does it explicitly justify the restriction as a required region-specific language policy.
The skill says out-of-scope legal regimes must be refused, yet another section instructs the agent to process those same matters. Such internal policy conflict is dangerous because the model may follow the more specific later instruction and silently bypass safety boundaries, producing unauthorized or unreliable legal analysis.
The skill metadata and boundary section state it is only applicable to the 《政府采购法》 regime, but later instructions say engineering projects should also trigger retrieval and conflict analysis under the 《招标投标法》 regime. This creates contradictory scope handling that can cause the agent to provide advice outside its declared competence, increasing the chance of incorrect legal guidance and unsafe user reliance.
The manifest presents the skill name and full description only in Chinese, with no indication that users can choose another language or that the skill is restricted to Chinese-speaking users. This can violate language/locale policy expectations when a skill is exposed in broader environments without explicit opt-in.
The README is entirely written as a Chinese-only skill persona and workflow description, with no indication that users may choose another language or locale. Under the policy rule for natural-language constraints, this reads as a default language restriction rather than an opt-in or clearly justified locale-specific language choice.
No suspicious patterns detected.
