Security audit
Security checks for vulnerabilities and agentic risk
This is a local China-market compliance checker that reads selected skill files and optionally writes a report, with no evidence of hidden network, persistence, or destructive behavior.
Use this skill when you specifically want a China/domestic-platform compliance preflight. Review the target directory before running batch summary mode, and treat results as advisory rather than legal approval.
The README states the skill is for domestic users and presents all user-facing guidance in Chinese, implying a fixed language/locale expectation. Under the policy rule, forcing a specific language or locale without opt-in or an explicit justified regional constraint is a natural-language policy concern.
Without declared permissions the skill's intent is opaque and cannot be validated.
The trigger list contains short, generic phrases such as "上架检查", "合规预检", "免责声明", and "敏感词" without clear scope limits or negative examples. In a manifest/markdown skill description, these broad terms may cause unintended invocation because they can naturally appear in many unrelated discussions about documentation or review.
The package description is entirely in Chinese and states the skill checks compliance with domestic regulatory requirements, implying a fixed language/locale scope without any user opt-in or alternative. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation unless the constraint is explicitly documented and justified.
The top-level description states the rules are for Chinese domestic AI app markets and is written as a China-specific compliance library, effectively constraining the skill content to a specific legal/locale context. The file does not present this as an optional locale choice or user-selectable region, so it can violate a language/locale policy when applied more generally.
The module docstring states the tool checks whether skills satisfy '国内监管合规要求', indicating a China-specific regulatory scope. The script does not present this as an optional locale/region mode or offer any user choice, which can violate language/locale policy when applied broadly.
The manifest specifically lists financial sensitive words, disclaimers, and safety red lines as examples of what is checked. The code adds PRIVACY and REGULATORY rule categories, extending the checker into additional compliance domains not disclosed in the manifest description.
The manifest describes an upload-time compliance checker for a skill, which implies evaluating the target skill itself. The summary command expands behavior into enumerating sibling directories, scanning multiple skills, and producing comparative rankings, which is broader operational scope than the stated purpose.
This markdown file contains substantive skill-related natural-language content only in Chinese, with no indication that the user can choose another language or that the locale is intentionally restricted. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
The comment at L1 is written only in Chinese, which can indicate a language-specific constraint without offering any user choice or opt-in. Under the policy, language or locale restrictions should be explicit and justified rather than implicitly imposed.
The command-line description hard-codes '上架合规检查器' and the overall tool behavior is oriented to a single locale/regulatory environment. While not inherently unsafe, this is a natural-language policy concern because no language or jurisdiction choice is offered in the interface.
No suspicious patterns detected.
