Security audit
Security checks for vulnerabilities and agentic risk
This is a narrowly scoped Chinese government procurement challenge and complaint drafting skill with disclosed legal-use boundaries and no executable or persistent behavior.
Before installing, treat the skill as an AI drafting assistant for Chinese government procurement challenge letters and complaints, not as a lawyer. Review generated legal citations, dates, evidence references, and local finance-authority practice before filing, and avoid using it for procurement contract disputes or tender-bidding-law matters outside its stated scope.
The prohibition section says the skill must not review procurement contracts or handle non-challenge legal documents, but elsewhere the documentation supports contract-related classification/handling. This inconsistency creates an exploitable policy gap: users can phrase contract disputes in mapped terms and induce the skill to provide assistance outside its authorized legal domain.
The skill’s tag mapping includes '履约验收 + 采购合同' for user inputs about acceptance failures or non-payment, which expands the assistant into contract-performance matters that the manifest and boundary section explicitly prohibit. This can cause the router or downstream logic to engage the skill for out-of-scope legal topics, leading to unauthorized legal drafting/advice and increased risk of inaccurate or noncompliant guidance.
The manifest presents the skill entirely in Chinese, including the main description of the assistant's behavior, and does not indicate that users may choose another language. Under the policy, language constraints should be opt-in or clearly justified as region-specific; here the procurement domain is Chinese, but the manifest does not explicitly document a language/locale limitation or offer alternatives.
