Security audit
Security checks for vulnerabilities and agentic risk
This paid QC skill largely matches its stated purpose, but it can send user artifacts to a remote paid service under broad trigger phrases before clear per-artifact upload consent.
Install only if you are comfortable sending the artifacts you ask it to inspect to the publisher's remote gateway and using the CNY 1.9 per-call WeChat Pay flow. Avoid using generic phrases for sensitive or private repositories unless you explicitly intend remote QC, and confirm what content will be uploaded before running it on directories or client/confidential files.
A skill presented as a comprehensive inspector but apparently limited to narrow PDF/render checks or sample output generation creates a trust-boundary violation. Because the skill is positioned as a final release gate, any misrepresentation is more dangerous than ordinary feature drift: it can suppress independent review and lead to publication of inaccurate, noncompliant, or insecure deliverables.
A skill presented as a comprehensive inspector but apparently limited to narrow PDF/render checks or sample output generation creates a trust-boundary violation. Because the skill is positioned as a final release gate, any misrepresentation is more dangerous than ordinary feature drift: it can suppress independent review and lead to publication of inaccurate, noncompliant, or insecure deliverables.
A skill presented as a comprehensive inspector but apparently limited to narrow PDF/render checks or sample output generation creates a trust-boundary violation. Because the skill is positioned as a final release gate, any misrepresentation is more dangerous than ordinary feature drift: it can suppress independent review and lead to publication of inaccurate, noncompliant, or insecure deliverables.
The localization routine performs global string replacement over the fully rendered HTML, including user/report data fields such as quoted source excerpts. That breaks the report’s own integrity guarantee that quotations are verbatim, and in this QC/reporting context it can silently alter evidence shown to customers, auditors, or downstream reviewers.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
**Three hard prohibitions**:
- ❌ **No rewriting** — the report stage never touches the original; edits require user confirmation
- ❌ **No author attribution** — never judge "was this written by AI"; only judge "can this be delivered"
- ❌ **No fabrication** — no adding numbers, quotes, or cases
---
The file requires use only in ways that comply with the laws and regulations of the People's Republic of China, which introduces a jurisdiction-specific policy constraint. For natural-language policy review, this is a locale/regional restriction that is not presented as an optional or clearly region-scoped condition for users outside that locale.
The trigger phrases are very broad and include common conversational requests such as 'check this for problems' and 'is this ready to publish'. In an agent skill system, ambiguous activation can cause the skill to run unintentionally on unrelated user requests, potentially changing routing, consuming paid calls, or exposing sensitive content to inspection logic when the user did not explicitly invoke this tool.
The documented '中文优先' policy enforces a Chinese-first behavior without clear opt-in, which can cause the skill to override user language expectations or process multilingual content in an unintended language. In a delivery-gate skill, this may produce confusing outputs, weaken review quality for non-Chinese artifacts, or create compliance issues if reports are generated in the wrong language.
The trigger phrases include very generic requests such as '帮我看看有没有问题', '检查一下这个', and '能不能发', which can overlap with ordinary conversation and cause the skill to activate outside the user's intended context. In an agent environment, this can lead to unsolicited inspection behavior, unintended processing of sensitive content, or routing away from the user's actual task.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
description: >-
The last gate before delivery! ontoAI QC Inspector Plus detects AI residue, content errors and compliance risks (RL1-RL4, six dimensions, L1-L7) in articles, reports, code, tables and decks; bilingual four-style reports. CNY 1.9 per call; monthly rule updates and priority support.
description_en: >-
The last gate before delivery! Every AI deliverable passes QC here — ontoAI Quality Inspector Plus. One-pass detection of AI residue, content errors and compliance risks (RL1–RL4 residue tiers, six QC dimensions, L1–L7 compliance lines incl. China Advertising Law and FTC truth-in-advertising) across articles, reports, code, data tables, slides, PDFs, web pages, audio/video and combined artifacts. Outputs bilingual four-style QC reports (HTML/PDF) with a four-tier verdict: Must Fix / Should Fix / Unverified / Passed. Report-only by default; never edits without confirmation; never fabricates. Plus edition: per-call billing CNY 1.9; monthly rule-pack updates, blockchain-notarized rule base (cert CZ20260215641694), priority support. Triggers: QC this, quality check, pre-delivery check, can I ship this, ontoAI QC.
allowed-tools:
- Read
- Write
The trigger list includes generic phrases like 'quality check' and 'can I ship this,' which are likely to appear in normal conversation and may invoke the skill unintentionally. In this skill's context, accidental invocation is more concerning because it can initiate external network calls and a payment workflow for user content.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
{ dim:"Residue", item:"No prompt leakage, no placeholders, no AI self-reference (except 1 above)" },
{ dim:"Authenticity", item:"All 23 figures cross-checked consistent (except 1 above)" },
{ dim:"Consistency", item:"Terms consistent; person/voice does not shift" },
{ dim:"Completeness", item:"All sections present; no truncation; captions complete" },
{ dim:"Compliance", item:"No superlatives, no key leakage, no private info" },
{ dim:"Adaptability", item:"Length fits public-account spec; image sizes compliant" },
{ dim:"Cross-modal", item:"All 5 figures match body description (anchor alignment 11/11)" }
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
{ dim:"Residue", item:"No prompt leakage, no placeholders, no AI self-reference (except 1 above)" },
{ dim:"Authenticity", item:"All 23 figures cross-checked consistent (except 1 above)" },
{ dim:"Consistency", item:"Terms consistent; person/voice does not shift" },
{ dim:"Completeness", item:"All sections present; no truncation; captions complete" },
{ dim:"Compliance", item:"No superlatives, no key leakage, no private info" },
{ dim:"Adaptability", item:"Length fits public-account spec; image sizes compliant" },
{ dim:"Cross-modal", item:"All 5 figures match body description (anchor alignment 11/11)" }
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
{ dim:"Residue", item:"No prompt leakage, no placeholders, no AI self-reference (except 1 above)" },
{ dim:"Authenticity", item:"All 23 figures cross-checked consistent (except 1 above)" },
{ dim:"Consistency", item:"Terms consistent; person/voice does not shift" },
{ dim:"Completeness", item:"All sections present; no truncation; captions complete" },
{ dim:"Compliance", item:"No superlatives, no key leakage, no private info" },
{ dim:"Adaptability", item:"Length fits public-account spec; image sizes compliant" },
{ dim:"Cross-modal", item:"All 5 figures match body description (anchor alignment 11/11)" }
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
{ dim:"Residue", item:"No prompt leakage, no placeholders, no AI self-reference (except 1 above)" },
{ dim:"Authenticity", item:"All 23 figures cross-checked consistent (except 1 above)" },
{ dim:"Consistency", item:"Terms consistent; person/voice does not shift" },
{ dim:"Completeness", item:"All sections present; no truncation; captions complete" },
{ dim:"Compliance", item:"No superlatives, no key leakage, no private info" },
{ dim:"Adaptability", item:"Length fits public-account spec; image sizes compliant" },
{ dim:"Cross-modal", item:"All 5 figures match body description (anchor alignment 11/11)" }
The document root is hard-coded to lang="zh-CN", and the script later defaults the UI language to Chinese unless DATA.lang is explicitly set to en. This imposes a specific language/locale on users without offering an explicit choice in the file's natural-language interface or documenting why the locale restriction is required.
The trigger list includes very broad everyday phrases such as '帮我看看有没有问题', '检查一下这个', and '能不能发', which can match many unrelated user requests and cause the skill to activate unintentionally. In this skill's context, accidental invocation is more concerning because the skill is allowed to use network-capable tools and may begin a QC workflow on arbitrary user content, creating prompt-routing confusion, unnecessary data exposure to the skill, and degraded agent reliability.
The entire skill file is written in Chinese and presents all instructions, expectations, and scoring criteria exclusively in that language. There is no indication that users may choose another language or that the locale restriction is required for a region-specific purpose, which makes this a natural-language locale policy concern.
This HTML file hard-codes lang: "zh", and later uses that value to set the document language to zh-CN unless the data is manually changed. That creates a default locale lock-in rather than offering the user a language choice or explicit opt-in.
This file declares lang="zh-CN" at the document root, which sets a fixed Chinese locale for the skill output. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy concern unless the restriction is explicitly justified, and no such justification or user-selectable language behavior is present in the file's default configuration.
lang: "zh" in the report data establishes Chinese as the default rendering language for generated output. Although the file contains English localization support elsewhere, the default behavior still forces one language without any visible user-consent or selection step in this file, which matches the language/locale policy violation criteria.
The script unconditionally rewrites the document language to English when DATA.lang is en, and the embedded content/data is also configured with lang: "en". This creates a fixed language choice without any user opt-in or documented justification, which matches the language/locale policy violation criteria.
This markdown file is entirely framed as a Chinese-only report/sample, including headings, instructions, and expected output, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
The HTML root sets lang="zh-CN", and the entire interface/content is authored only in Simplified Chinese, which imposes a specific language/locale on all users. The file does not offer any language selection or explain that the report is intentionally limited to a China-specific audience or compliance context.
This markdown file is entirely written in Chinese and presents normative skill guidance without any indication that the language is optional, configurable, or limited to a China-specific deployment. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal