Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for Qianlu inquiry spreadsheet standards, with no hidden execution, persistence, credential use, or unrelated access.
Install this if you want an agent to answer Qianlu inquiry-system document-standard questions or help check spreadsheet headers and names. Before using upload delegation or Excel inspection, confirm the target file and destination because those actions depend on user-provided business documents and any separately installed filebrowser tool.
The document states that the exported 回询单 uses English headers, which imposes a specific language format. Because no user opt-in, alternative locale, or explicit business/compliance justification is provided here, this is a natural-language locale policy concern under the stated rule.
This line requires re-imported order files to use English headers matching the predefined format. That enforces a language/locale choice, and the document does not explain a justified regional or interoperability requirement nor provide an opt-in mechanism.
The manifest description includes a generic activation list such as “表头命名、单据核验、报价对比矩阵、两子系统边界” without defining exact trigger phrases, scope limits, or negative examples. This creates ambiguity about when the skill should activate versus when ordinary discussion of documents, naming, or validation should not invoke it.
L207-L208 明确规定“所有业务术语、UI 用词、文件名规范”必须以该目录文档中的统一命名为准，并强制使用特定中文术语如“替换号”“采购单”。这构成了语言/术语层面的强制要求，但文档中没有提供用户或部署方的语言/locale 选择，也没有说明这是受地区合规或业务地域限制所必需。
No suspicious patterns detected.
