Security audit
Security checks for vulnerabilities and agentic risk
This skill is a focused document-analysis helper that reads user-provided automotive quality documents and creates a local CSR judgment report, with no evidence of hidden execution, network access, or credential use.
Before installing, be aware that uploaded quality documents may contain supplier or customer-sensitive information, and the generated CSR report will be saved as a local Markdown file. Use it for intended automotive CSR analysis and delete generated reports if they should not remain on disk.
The trigger rules include broad everyday phrases such as '分析这份文档' and '帮我看看这份' when an attachment is present. This can cause the skill to activate on unrelated uploads, leading to unintended processing of non-automotive documents and unnecessary access to user-provided content.
The skill states that uploaded documents are analyzed only within the current session and are not retained, yet the workflow explicitly requires writing a persistent Markdown report to disk. This creates a data-handling inconsistency that can expose sensitive customer or supplier quality information beyond the session boundary and misleads users about retention behavior.
No suspicious patterns detected.
