Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly static China privacy-compliance guidance, but it includes an out-of-scope commercial web-app promotion that could redirect compliance content to an external service without data-handling disclosure.
Install only if you want static China data-compliance guidance, and avoid pasting sensitive policy drafts, business data, or regulated content into the promoted external web app unless you have independently reviewed its operator, terms, and data handling. Treat legal thresholds and cloud commands as starting points requiring current legal and infrastructure review.
The activation scope is broad enough to trigger on generic China data-protection or dual-compliance questions, which increases the chance of this skill being auto-invoked in contexts where its assumptions do not fit. Over-broad triggering can lead to inappropriate guidance, unwanted data-localization advice, or unnecessary redirection to external resources in sensitive legal/compliance workflows.
The instruction "Required sections in Chinese privacy policy" imposes a specific language requirement in natural-language guidance. While the skill is China-focused, the file does not clearly frame this as a locale-specific recommendation or offer user choice, so it reads as a blanket language mandate.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
2. Collecting data not mentioned in privacy policy
3. Bundled consent (forcing all-or-nothing)
4. No account deletion function
5. Background location/collection without consent
6. SDK not disclosed in privacy policy
## Safety Rules
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Safety Rules
1. **Never skip consent** — PIPL requires separate, explicit, informed consent
2. **Data minimization** — only collect what you need, delete when purpose is fulfilled
3. **China storage first** — default to China regions for Chinese user data
4. **Document everything** — keep consent records, assessment reports, audit logs
The skill is presented as a China data-protection compliance guide, but it embeds promotion for an unrelated web app offering banned-word, SEO, and platform-specific content checks. This expands the trust boundary and can steer agents or users toward an external service that is outside the declared purpose, creating risk of misrouting sensitive compliance data or enabling hidden commercial influence.
The SEO-compliance and banned-word-checking claims are not justified by the skill's stated purpose of PIPL/Cybersecurity Law/Data Security Law guidance. This kind of scope drift can cause an agent to invoke irrelevant functionality, trust unrelated recommendations, or share regulated business content with a third-party service under the guise of legal compliance assistance.