Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language supply-chain workflow skill made of Markdown guidance and templates, with expected business-data sharing risks but no hidden code or unsafe execution behavior found.
Install only if you are comfortable using a Chinese-language procurement workflow. Before sending forms to suppliers, verify the recipient, share only necessary contact and technical details, use an NDA for confidential designs or BOMs, and follow your organization’s approval process for external disclosure.
The manifest description is written entirely in Chinese and the rest of the skill instructions are likewise Chinese-only, with no indication that users may choose another language. Under the policy for natural-language violations, a skill that effectively enforces a specific language without opt-in should be flagged unless the locale constraint is explicitly justified.
The SOP instructs users to send supplier request forms containing personal contact details, technical drawings, BOMs, and other commercially sensitive materials, but it does not require any external sharing review, data minimization, recipient verification, NDA gating, or classification checks before disclosure. In a supply-chain matching skill, this omission can lead to accidental leakage of PII, proprietary design/IP, or sensitive business terms to the wrong party or to insufficiently vetted suppliers.
This markdown file contains user-facing instructions and descriptions exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.
规则要求关注自然语言中的语言/地区策略违规；该文档以中文独占方式编写，未提供用户可选择语言的说明，也未声明这是仅面向中文使用场景的受限文档。若该技能面向通用用户，这种固定语言输出可能构成未获用户选择的语言限制。
The form content is written in Chinese throughout, with only a brief English subtitle, and provides no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
This markdown template asks for联系人、联系电话、邮箱 and later requests design files such as Gerber/CAD/BOM, which may contain sensitive personal or proprietary information. There is no warning or guidance about protecting, minimizing, or securely handling that data anywhere in the document.
This markdown template is entirely written in Chinese and does not offer any language or locale choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
