china-data-compliance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 2.3.0

Overview

The skill is mostly static China privacy-compliance guidance, but it includes an out-of-scope commercial web-app promotion that could redirect compliance content to an external service without data-handling disclosure.

Install only if you want static China data-compliance guidance, and avoid pasting sensitive policy drafts, business data, or regulated content into the promoted external web app unless you have independently reviewed its operator, terms, and data handling. Treat legal thresholds and cloud commands as starting points requiring current legal and infrastructure review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation scope is broad enough to trigger on generic China data-protection or dual-compliance questions, which increases the chance of this skill being auto-invoked in contexts where its assumptions do not fit. Over-broad triggering can lead to inappropriate guidance, unwanted data-localization advice, or unnecessary redirection to external resources in sensitive legal/compliance workflows.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The instruction "Required sections in Chinese privacy policy" imposes a specific language requirement in natural-language guidance. While the skill is China-focused, the file does not clearly frame this as a locale-specific recommendation or offer user choice, so it reads as a blanket language mandate.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. Collecting data not mentioned in privacy policy
3. Bundled consent (forcing all-or-nothing)
4. No account deletion function
5. Background location/collection without consent
6. SDK not disclosed in privacy policy

## Safety Rules

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety Rules

1. **Never skip consent** — PIPL requires separate, explicit, informed consent
2. **Data minimization** — only collect what you need, delete when purpose is fulfilled
3. **China storage first** — default to China regions for Chinese user data
4. **Document everything** — keep consent records, assessment reports, audit logs

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as a China data-protection compliance guide, but it embeds promotion for an unrelated web app offering banned-word, SEO, and platform-specific content checks. This expands the trust boundary and can steer agents or users toward an external service that is outside the declared purpose, creating risk of misrouting sensitive compliance data or enabling hidden commercial influence.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The SEO-compliance and banned-word-checking claims are not justified by the skill's stated purpose of PIPL/Cybersecurity Law/Data Security Law guidance. This kind of scope drift can cause an agent to invoke irrelevant functionality, trust unrelated recommendations, or share regulated business content with a third-party service under the guise of legal compliance assistance.

Static analysis

No suspicious patterns detected.