Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-language NPL valuation and due-diligence knowledge skill with local calculators, not a hidden or privilege-seeking tool.
Install only if you want Chinese-language NPL valuation and disposal reference material. Treat the calculators as rough models with assumptions, verify parameters and legal facts independently, and do not rely on the skill as investment, legal, or valuation advice for real bids without professional review.
The skill advertises concrete valuation, bid-cap, due-diligence, and regional pricing capabilities, but the described implementation appears not to provide those functions. In a financial decision-support context, this mismatch can mislead users into relying on incomplete or absent analysis for bidding or investment decisions, creating real monetary and compliance risk even without malicious code execution.
The trigger terms include broad industry words such as '尽调', '估值定价', '处置', and '抵押物', which are common across many finance and legal discussions. Overbroad activation can cause the skill to trigger in irrelevant contexts, leading users to receive specialized NPL guidance when it was not intended, increasing the chance of confusion or misuse.
This markdown file presents all instructions and reference content exclusively in Chinese, with no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context. Under the language/locale policy, forcing a specific language without user opt-in or justification is a natural-language policy concern.
This markdown file presents all operational guidance exclusively in Chinese, and there is no natural-language indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy rule, forcing a specific language without user opt-in is a reportable locale-policy issue.
The entire skill content is presented only in Chinese, and there is no indication that users can opt into another language or locale. Under the policy rule for natural-language violations, a skill that effectively mandates a specific language without user choice can be flagged unless the locale restriction is explicitly documented and justified.
The entire skill reference is written in Chinese and labeled for an assistant expert system, but it does not indicate that Chinese is optional, user-selected, or required for a clearly documented region-specific purpose. Under the language/locale policy, a skill should not implicitly force a specific language without opt-in or justification.
This markdown file presents all instructions and content in Chinese, and does not indicate that the skill is region-specific or provide any user opt-in for language preference. That can violate language/locale policy when a skill implicitly forces a specific language on users.
This Python file’s top-level docstring is entirely in Chinese and presents the tool as a general-purpose disposal decision model, while later user-facing prints are also exclusively Chinese. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
The demo and recommendation output shown to users is fully localized to Chinese, including headings, labels, and recommendations. Because the file does not offer an alternate language path or explicit opt-in, this appears to enforce a locale choice rather than letting the user select it.
This file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.
This markdown file contains only Chinese-language instructional content and does not provide user opt-in, alternatives, or justification for restricting the skill content to a single language. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
This markdown file is entirely written in Chinese and does not mention any user language selection, alternative locale, or justification for enforcing a single language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown file presents all instructional content in Chinese and does not indicate that the user can select another language or that the skill is intentionally limited to Chinese-language use. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
This markdown content forces a single language/locale for all users through its natural-language presentation. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific.
This markdown file contains only Chinese-language content and does not indicate that the skill is region-specific or that users may choose another language. Under the natural-language policy rule, forcing a specific language without user opt-in can be a policy concern.
The entire skill reference content is written in Chinese and does not indicate that language selection is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The entire skill content is presented only in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified.
This file contains only Chinese-language content and does not provide an explicit user opt-in, alternative language option, or justification that the skill is intended solely for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
This file hard-codes its title, usage instructions, prompts, help text, and output labels in Chinese, which imposes a specific language on users without offering opt-in or alternative locale support. The policy allows locale constraints when explicitly documented and justified, but this file does not state that it is intended only for Chinese-speaking or region-specific users.
This code file hard-codes user-facing natural-language content in Chinese, including the top-level description and usage examples, and the same pattern continues in argument descriptions and runtime output. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the regional restriction is clearly documented and justified.
L327 的示例使用 --tier 成都 --compare，但 estimate_npl 在 L130-L132 只接受 CITY_TIER_PARAMS 中定义的能级值（一线/新一线/二线/三线/四线）。这会让使用者认为可直接输入具体城市，与代码实际行为相冲突。
This markdown file contains only Chinese-language content and does not indicate that the skill is region-specific or that users may choose another language. Under the natural-language policy rule, forcing a specific language without opt-in can be a locale-policy violation.
This markdown template presents all headings and fields exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or scope limitation is stated. There is no indication that the skill is region-specific or that users may choose another language.
No suspicious patterns detected.
