Security audit
Security checks for vulnerabilities and agentic risk
This is a static Chinese tax quick-reference skill with a disclosed paid add-on promotion, and it does not contain code, hidden execution, persistence, credential access, or destructive behavior.
Install only if you want a Chinese-language mainland China tax quick reference. Treat it as a quick lookup, not professional tax advice; verify filing deadlines, local rules, and current official notices before acting. The paid SkillPay section should require your explicit confirmation before any purchase or additional skill installation.
The trigger text is broad enough to auto-load on many ordinary tax questions, which can cause the agent to invoke this skill outside a narrowly bounded use case. In this specific file the content is informational rather than code-executing, so the main risk is misrouting, over-application of tax guidance, or unintended purchase-prompt exposure rather than direct compromise.
The invocation guidance tells the agent to use the skill for broad, everyday tax questions such as VAT rates, individual income tax, and filing deadlines without clearly limiting when the content is only a quick reference versus when authoritative, current, jurisdiction-specific verification is required. In a tax domain, over-broad triggering can cause the agent to answer compliance-sensitive questions from a static table even when facts, entity type, province, invoice type, or updated rules materially change the correct outcome.
All user-facing descriptions, trigger phrases, and instructions are written only in Chinese, which can amount to a forced language/locale assumption under the policy if no user opt-in or justification is provided. The file does not explicitly state that the skill is intended only for Chinese-speaking users or for mainland China tax workflows as a documented locale constraint.
The display name, description, and usage instructions are entirely in Chinese and present the skill as the default interaction mode for tax questions. There is no indication that users may choose another language or that the Chinese-only presentation is an explicit opt-in or documented locale constraint.
