Security audit
Security checks for vulnerabilities and agentic risk
This is a conversational banking compliance review aid with disclosed workflows and no artifact-backed signs of code execution, persistence, exfiltration, or hidden authority.
Install only if you want a Chinese/China-focused banking compliance assistant. Treat its regulatory analysis as drafting and screening support, not final legal or compliance approval, and avoid pasting unnecessary customer personal data unless your environment is approved for that use.
All declared trigger phrases are Chinese-only, and the usage examples and operational templates are also entirely Chinese, while the document does not state that the skill is limited to Chinese-language users or provide an opt-in language choice. This can violate language/locale policy because it implicitly enforces a specific language without user selection.
The trigger list contains very broad, generic compliance phrases such as 合规审查, 合规审核, and 合规检查 that are likely to match normal user conversation outside the intended banking niche. This can cause the skill to activate unintentionally and steer unrelated chats into a regulated workflow, increasing the chance of inappropriate guidance or context capture in sensitive conversations.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
|------------|----------|------------|
| Missing Risk Disclosures | 未披露产品风险、净值波动 | MEDIUM |
| Incomplete Fee Disclosures | 手续费、管理费披露不完整 | MEDIUM |
| Regulatory Sensitive Terms | CBIRC/CBDRC regulated terms without approval | MEDIUM |
| Competitive Disparagement | 贬低其他银行/金融机构产品 | MEDIUM |
| Missing Legal Disclaimer | 缺少法定免责声明 | HIGH |
The trigger list uses very broad banking/compliance phrases such as '合规审查', '反洗钱', and '合规风险', which are likely to match ordinary user requests beyond the intended narrow workflow. In a banking context, overbroad activation can cause the skill to intercept sensitive regulatory, KYC, or AML-related conversations unexpectedly, increasing the chance of inappropriate workflow injection, misrouting, or unnecessary exposure of sensitive compliance content.
All declared triggers are Chinese phrases, and the manifest does not indicate that users may invoke the skill in other languages or that the Chinese-only scope is intentionally limited to a specific locale. This can violate language/locale policy when a skill implicitly requires one language without opt-in or explicit regional justification.
No suspicious patterns detected.