Security audit
Security checks for vulnerabilities and agentic risk
This is a narrow business scoring helper with no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Installers should expect Chinese-language documentation and recommendation labels. Use this skill for lightweight business-channel prioritization, and verify the underlying assumptions before making financial decisions from its scores.
The skill documentation is entirely written in Chinese, including the title and all usage instructions, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. This can violate language/locale policy because it imposes a specific language on users without opt-in or justification.
The trigger phrases are broad business terms such as 'ROI 评估' and '是否值得', which can appear in ordinary conversation unrelated to this specific skill. This can cause unintended invocation, leading the agent to apply a rigid scoring framework when the user did not explicitly request it, potentially degrading reliability or causing unauthorized workflow activation.
All user-facing instructions, triggers, and output format are specified only in Chinese, with no indication that other languages are supported or that Chinese is a justified regional requirement. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This markdown file presents all headings and content in Chinese without indicating that other languages are supported or that the language choice is intentional and user-selected.
This markdown file presents all user-facing instructional content exclusively in Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.
This code uses Chinese recommendation labels and output text in string literals, which forces a specific language/locale on users without any opt-in or alternative. The policy for natural-language violations applies to all file types, including code files, so this is in scope.
No suspicious patterns detected.
