Security audit
Security checks for vulnerabilities and agentic risk
This is a non-executable insurance-claims workflow skill, but it contains conflicting boundaries around high-impact actions like claim calculation, customer notices, fraud monitoring, closing cases, and archiving.
Install only if you want a Chinese insurance-claims workflow reference and will keep all claim decisions, system lookups, notices, payments, fraud actions, closing, and archiving under explicit authorized human control. Do not connect this skill to tools that can send customer messages, close cases, archive documents, or query medical/customer history unless you add tighter confirmation gates and institution-specific compliance controls.
The file repeatedly claims the skill does not call interfaces or tools, yet later provides concrete system capability invocations and an MCP calculation call sequence. This inconsistency can mislead reviewers and users about the real operational scope, causing unsafe overtrust and accidental enablement of sensitive actions against claims, policy, medical, or notification systems.
Module 3 uses broad trigger phrases such as ordinary references to fees, prescriptions, or hospitalization, which can activate medical review logic during routine conversation. In a claims setting, unintended activation can cause the model to solicit or process unnecessary medical and billing details, expanding exposure of sensitive health information beyond the user's intent.
Module 4 trigger terms like '免责' or '拒赔' are too underspecified and may fire on general policy discussion rather than a request for exclusion analysis. This can push the skill into premature liability or denial-oriented reasoning, which is especially risky in regulated claims handling where decisions must be evidence-based and tightly scoped.
Module 5 includes generic terms like '理算' and '赔付比例' that are common in ordinary claims discussions, making accidental activation likely. If triggered unintentionally, the workflow may prompt for or structure sensitive claims, policy, and payment inputs in contexts where the user only wanted an explanation, increasing data exposure and process confusion.
Broad fraud-related triggers can activate on casual mentions of fraud or risk, causing the skill to begin a fraud-assessment workflow without sufficient specificity. In insurance operations this is sensitive, because unnecessary fraud screening can drive collection of historical, medical, or behavioral data and may bias subsequent claim handling.
Module 8 trigger phrases overlap with routine support and status conversations, so the skill may begin generating formal notice or communication drafts when the user only wants general assistance. That can lead to premature or inaccurate customer-facing content in a regulated claims context, especially where denial, payment, or supplement requests carry legal significance.
The maintenance note says close-out, archiving, and notification actions were removed, but Module 8 still instructs those same actions, creating contradictory execution boundaries. In a high-sensitivity insurance workflow, operators or downstream agents may rely on the later instructions and perform status updates, notifications, or archiving without the intended safeguards, increasing the chance of unauthorized data handling or premature customer communications.
The file is largely written in Chinese and all operational examples, triggers, and output structures are presented in that language, but it does not explicitly offer the user a choice of language or locale for interaction. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern unless justified or optionality is provided.
No suspicious patterns detected.
