Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese-language buyer-side contract review workflow that may generate a DOCX redline, with no evidence of hidden execution, persistence, exfiltration, or unrelated authority.
Before installing, users should understand that the skill applies Chinese buyer-side commercial defaults, including specific VAT invoice and payment rules, and that full review or revision requests are expected to produce a new DOCX redline containing contract text. Use it with appropriately authorized contract materials and confirm output filename/location if overwrite avoidance matters.
The manifest description and the rest of the skill instructions are written as mandatory Chinese-language workflow/output guidance, including fixed Chinese output structures and terminology. There is no indication that the user may choose another language or that the Chinese-only constraint is explicitly justified as a region-specific policy requirement.
The skill explicitly promises delivery of a revised .DOCX with tracked changes, which implies creating or modifying a user file, but the test content does not disclose that side effect or require explicit user confirmation before file generation. In an agent setting, silent file creation/modification can surprise users, overwrite expected outputs, or cause unintended handling of sensitive contract text, especially because procurement contracts often contain confidential commercial information.
This markdown file uses Chinese for the substantive contact and maintainer information, and does not provide an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
All visible natural-language instructions and test cases are in Chinese, and the file does not indicate that language is optional or limited to a justified region-specific context. Per the policy rule, forcing a specific language without opt-in can be a locale-policy issue.
This markdown file contains end-user-facing natural language exclusively in Chinese, and there is no statement that the skill is China-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
No suspicious patterns detected.
