Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only payment integration skill with visible financial API guidance and no hidden execution, persistence, or exfiltration behavior.
Install only if you want guidance for integrating 粤收付 payment and funds-movement APIs. Because it includes refunds, transfers, withdrawals, and profit sharing, generated code should be reviewed carefully, tested in sandbox, and guarded with merchant-side authorization and idempotency before production use.
Manifest 将技能范围限定为交易集成，并明确排除了商户进件/业务开通相关任务。但在 L093-L106 中，技能把“申请开通分账、后台建分组、绑定接收方”等能力纳入核心内容，尤其 L098 的“绑定分账用户”是账户/业务配置操作，不只是下单、查单、退款等交易接口对接。
The visible skill title, description, and interaction framing are entirely in Chinese, while line L010 labels it as a 'multi-language interface integration expert'. There is no explicit statement that users may choose their preferred language, so the natural-language policy appears to default to a specific language without opt-in.
No suspicious patterns detected.
