Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed reference workflow for wealth-management staff, not an executable skill, with sensitive financial-data handling bounded by human review and institutional controls.
Install only if you are comfortable using it as a Chinese-language, human-reviewed wealth-management workflow. Do not enter full identity numbers, account numbers, or unnecessary household financial details; use institution-approved data sources and generate or save reports only after authorized review.
The manifest description at L0004 is entirely Chinese, and the document then primarily instructs users in Chinese. For a skill file, this can effectively impose a language/locale constraint without explicit user opt-in or a documented region-specific justification, which matches the language/locale policy concern.
The execution-boundary section states the skill does not force any step and that wording like '必须执行' only reflects recommended workflow order, not mandatory behavior. However, several module instructions and output requirements still explicitly say charts 'must be generated' or are 'required', which directly conflicts with that boundary clarification and could mislead users about whether the skill mandates those actions.
The document strongly claims the skill does not save, export, or automatically produce files, yet later recommends using RenderHtmlToPdf to generate a PDF report. That contradiction can cause operators to disclose sensitive household financial data into file-generation workflows that appear blessed by the skill, weakening the stated data-boundary guarantees and increasing the chance of unauthorized persistence or external transfer.
No suspicious patterns detected.
