Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent machine-vision quality-control aid, but users should manage its persistent inspection logs and feedback data carefully.
Install only in a workspace where persistent QA logs are acceptable. Treat image paths, feature vectors, defect decisions, and human annotation notes as potentially sensitive production data, and set your own retention, access-control, and deletion practices before use.
The natural-language content in this file is presented only in Chinese, including operational checklist items and trigger conditions. Under the policy, forcing a specific language without user opt-in or justification is a language/locale policy violation.
The README explicitly states that all detection results are written to logs, but provides no notice about retention, sensitivity, access controls, or deletion. In an industrial vision workflow, logs may include image identifiers, defect metadata, timestamps, operator-linked decisions, or production-quality records, which can expose sensitive operational information if retained indefinitely or accessed broadly.
The skill says human annotation feedback is used for continued improvement, but does not warn that feedback notes may be stored, reused, or incorporated into future training data. Those notes can contain sensitive plant, customer, or defect-investigation details, creating privacy, confidentiality, and governance risks if operators are unaware of secondary use.
The skill explicitly states that each detection result is written to a dated JSONL log file, but the documentation provides no warning, consent model, retention policy, or guidance on handling potentially sensitive production data. In a manufacturing/quality-control context, these logs may contain defect histories, filenames, timestamps, or proprietary packaging design metadata that could expose operational details if retained insecurely or shared unintentionally.
The protocol explicitly requires persistent logging of raw image paths, feature vectors, confidence values, and decisions, but it provides no retention limits, access controls, minimization rules, or operator notice. In a machine-vision QA context, stored image paths and feature vectors can reveal proprietary production data, sensitive file-system structure, or enable later reconstruction/inference about inspected materials, making unauthorized retention and disclosure a real security and privacy risk.
Large parts of the user-facing documentation, including metadata and core capability descriptions, are presented only in Chinese. This can amount to a language policy issue when the skill does not offer an explicit language option or explain that it is intended only for a Chinese-language audience.
This file uses a single fixed language for operational instructions and templates, and it does not indicate that the user may choose another language or that the Chinese-only format is required for a region-specific purpose. That constitutes a natural-language locale policy concern under the stated rule.
No suspicious patterns detected.
