Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese supplier-improvement report generator with disclosed document output and no evidence of hidden access, exfiltration, persistence, or unsafe behavior.
Before installing, confirm you want a Chinese-language supplier-development workflow and only provide supplier performance data you are allowed to place in generated reports. If the agent tries to run scripts/build_report.py, verify the script's source and output directory first because the script was not included in the inspected artifact.
The natural-language description explicitly states 中文文档, indicating the skill is intended to produce Chinese documents. Because no user opt-in or alternative language option is offered, this is a locale/language policy concern under the stated rule.
The skill explicitly instructs the agent to generate Markdown and text files on disk, but it does not require notifying the user, confirming the destination, or constraining the output path. In an agent environment, silent artifact creation can cause unintended data persistence, clutter shared workspaces, or write sensitive business planning content to locations the user did not expect.
