Security audit
Security checks for vulnerabilities and agentic risk
This is a non-executable credit-risk workflow reference that handles sensitive banking scenarios but repeatedly confines actions to human-reviewed drafts and institution-controlled systems.
Install only if you want a Chinese-language banking credit-risk reference workflow. Do not put raw customer, account, ID, credit-report, health, or transaction data into the skill unless it has been minimized and desensitized, and treat every output as a draft requiring qualified human review in your institution’s controlled systems.
The manifest description is entirely in Chinese and the document consistently specifies role, workflow, outputs, and report formats in Chinese, effectively imposing a single language/locale for interaction and deliverables. The file does not clearly offer an alternative language option or ask for user preference, so this creates a natural-language locale policy concern.
The update log states that remaining confirm/approve confirmation mechanism usages were unified and that no non-human-confirmation steps remain. However, Module 5 and Module 7 still explicitly use 确认机制：approve in their workflow and audit-trail examples, which contradicts the stated documentation-level guarantee about uniform confirmation semantics.
The maintenance note says references to scripts and spec files not present in the package were removed. Yet earlier sections still direct the reader to METHODOLOGY.md (L0104) and to validation or script requirements from unspecified institutional scripts (for example L0446, L1055, L1669, L2228), which contradicts that cleanup claim.
No suspicious patterns detected.
