Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a static export-control guidance document, but it promotes an unrelated third-party content-compliance web app without clear scope or data-handling disclosure.
Review the unrelated Web App promotion before installing or using this skill. The Markdown guidance does not install code or request privileges, but users should avoid sending sensitive product, customer, or export-review details to the linked external service unless they have independently verified who operates it and how submitted data is handled. Treat the legal/compliance content as general guidance and confirm current requirements with qualified counsel or official sources.
The when_to_use field ends with or any China export control question, which is an overly broad natural-language trigger for a manifest/markdown file. This can cause the skill to activate for general discussion or high-level questions without clear scope boundaries or exclusion conditions.
The skill is presented as Chinese export-control guidance, but it embeds and promotes an unrelated external web app for 'forbidden words', SEO checks, and platform content compliance. This creates a scope-integrity problem: users may be redirected to a third-party service that is irrelevant to export control, causing confusion, misplaced trust, and possible data disclosure to an unvetted external endpoint.
The web app section is presented entirely in Chinese and framed as a direct path for users who do not want to code, but it does not indicate whether other language options are available. This can conflict with a language/locale policy requiring user choice rather than implicitly enforcing a specific language.
The file describes itself as an export-control compliance expert, but the library branding reclassifies it as part of 'Chinese content compliance' offerings. This inconsistency can mislead users about the provenance and intended function of the skill, weakening trust boundaries and increasing the chance that users rely on mismatched or inapplicable compliance advice.
No suspicious patterns detected.
