Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent local reference helper for applying GB/T 47041-2026 and does not show hidden, destructive, persistent, or exfiltrating behavior.
Install this if you want help applying GB/T 47041-2026. Treat its outputs as standards-reference assistance, not official legal, medical, licensing, or accreditation advice, and verify high-stakes conclusions against the source standard and the relevant authority.
The skill references local assets and scripts and instructs reading files, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, undeclared file-read capability can cause the skill to be invoked with broader filesystem access than intended, increasing the chance of unauthorized disclosure of adjacent files or misuse of host data.
The activation description is broad enough to capture general compliance, service quality, staffing, facilities, and evaluation requests that may not actually be about GB/T 47041-2026. Over-broad routing can cause the wrong skill to activate, leading users to receive authoritative-sounding guidance from a narrow standard in situations where a different jurisdiction, standard, or domain-specific policy should apply.
Line L156 states that staff service language and behavior should be civilized, and specifically requires the service language to conform to autistic children's cognitive characteristics, within a document otherwise written as a national standard in Chinese with no indication that other languages or communication modes are permitted. This creates a natural-language locale policy concern because the document appears to prescribe a specific language context without explicit user opt-in or a clearly documented regional-language limitation.
The description hardcodes use of 'the Chinese national standard' and includes Chinese-language trigger terms, but does not indicate whether responses can adapt to the user's preferred language or locale. This can violate language/locale policy when a skill implicitly forces a specific regional or language context without explicit opt-in.
The file instructs users in English to use the map and presents the clause map entirely in English, while referencing a Chinese standard. This imposes a language choice without any opt-in or documented justification for why English is required.
The guide explicitly centers a Chinese standard and includes Chinese title text, but it does not state whether users may request an alternative language or locale. Under the policy rule, language or locale constraints should either be optional or clearly justified to avoid forcing a specific language context on users.
