Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Chinese invoice-process FAQ skill with no evidence of hidden execution, data access, persistence, or unsafe automation.
Before installing, confirm this FAQ is intended for your Chinese-language finance workflow and that staff use approved internal channels when sharing invoice, customer, contract, or payment information.
This markdown file presents the contact and maintainer information entirely in Chinese after an English title, with no indication that other languages are available. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified.
All visible skill instructions and content are fixed in Chinese, and the workflow requires answers to follow the source text strictly without offering any language choice. This can amount to a language policy violation when users are not given an option to receive responses in another language.
The trigger list includes generic phrases such as '发票管理' and '开票流程' without any boundary conditions or negative examples. Because the description does not clarify when the skill should activate versus when ordinary conversation about invoices should not, it risks unintended invocation.
This is a markdown file, so SQP-2 applies to missing warnings in the skill description. Line L106 instructs staff to send potentially sensitive financial and customer-related information by email, but the document provides no caution about data sensitivity, approved channels, or privacy handling.
This markdown file presents all operational guidance exclusively in Chinese and does not indicate any user choice of language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
The entire skill document is written only in Chinese and does not mention any user language preference, translation option, or region-specific justification. Under the policy rule, hard-coding a single language without opt-in can be a natural-language locale policy issue.
The module docstring presents the skill name in Chinese while the surrounding description is in English, which implies a language choice has been made by the skill author rather than the user. The file does not indicate that the user can opt into a preferred language or that the locale constraint is intentional and justified.
This markdown file presents all user-facing examples and expected outputs exclusively in Chinese, which may imply a fixed language behavior. The policy flags language or locale constraints when the skill forces a specific language without user opt-in or justification.
This markdown file contains user-facing natural language exclusively in Chinese, and there is no statement that the skill is intended only for Chinese-speaking users or that language selection is configurable. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
No suspicious patterns detected.
