Security audit
Security checks for vulnerabilities and agentic risk
The skill is a markdown-only guide for generating Chinese patent and software-copyright documents, with expected but privacy-sensitive project analysis and online prior-art search steps.
Install only if you want a China-focused patent/software-copyright drafting helper. Before using prior-art search, ask the agent to show and sanitize search queries so confidential code, unpublished invention details, keys, endpoints, names, and business data are not sent to external services.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
---# AI项目软件著作权登记特殊指南
## 1. AI项目类型识别
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
---# AI项目软件著作权登记特殊指南
## 1. AI项目类型识别
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
---# AI项目软件著作权登记特殊指南
## 1. AI项目类型识别
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
---# AI项目软件著作权登记特殊指南
## 1. AI项目类型识别
The trigger list contains broad generic terms such as "patent," "claims," and "specification," which are common in normal discussion and could cause the skill to activate unintentionally. In a skill that processes project code, docs, and potentially sensitive IP, accidental invocation increases the chance of unnecessary data exposure or execution of privacy-impacting workflow steps.
The skill instructs the agent to perform online prior-art searches against external services using project-derived technical information, but it does not disclose network access, data sharing, or require consent/redaction before transmission. Because the skill is specifically designed to analyze proprietary code, design docs, and research papers for patent drafting, this creates a meaningful risk of leaking confidential or unpublished invention details to third-party systems.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- [ ] 删除内网地址和域名
- [ ] 删除个人邮箱、姓名
- [ ] 删除具体硬件型号（A100/H100→GPU，Jetson→边缘计算设备）
- [ ] 删除云服务端点URL（替换为 `https://api.example.com/`）
- [ ] 删除数据库连接串中的密码
- [ ] 保留注释中关键算法说明（审查员可能参考）
The title and the overwhelming body of the guide are presented in Chinese, with no indication that language selection is optional or that the skill is intended only for Chinese-speaking users or a China-specific legal context. Under the policy rule, a fixed language or locale without user opt-in can be a natural-language policy violation.
This markdown file contains instructional content exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale-policy violation.
This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. That can conflict with language/locale policy expectations when a skill is intended for a broader audience.