Security audit
Security checks for vulnerabilities and agentic risk
This skill is a China-market research helper that uses disclosed public official websites and a small standard-library script without persistence or hidden credential handling.
Install this only if you want a China-official-source market research workflow. Avoid entering secrets, cookies, login-only data, or personal sensitive information; treat submitted search terms as visible to the public official sites being queried.
The skill clearly instructs use of networked resources and a browser/API script, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where an agent may use broader network capabilities than intended, increasing the chance of uncontrolled outbound access or policy bypass through ambiguous execution context.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 场景 | 资源 | URL | 用法 |
| --- | --- | --- | --- |
| 宏观经济 | 国家统计局国家数据 | https://data.stats.gov.cn/ | GDP、CPI、PPI、PMI、工业、社零、固定资产投资、房地产、人口、就业 |
| 宏观经济 | 国家统计局官网 | https://www.stats.gov.cn/ | 统计公报、月度/年度统计、专题数据、新闻发布稿 |
| 金融货币 | 中国人民银行调查统计 | https://www.pbc.gov.cn/diaochatongjisi/116219/index.html | M2、社融、贷款、利率、金融统计报告 |
| 外汇 | 国家外汇管理局统计数据 | https://www.safe.gov.cn/safe/tjsj1/index.html | 外储、汇率、国际收支、结售汇、跨境收支 |
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 宏观经济 | 国家统计局官网 | https://www.stats.gov.cn/ | 统计公报、月度/年度统计、专题数据、新闻发布稿 |
| 金融货币 | 中国人民银行调查统计 | https://www.pbc.gov.cn/diaochatongjisi/116219/index.html | M2、社融、贷款、利率、金融统计报告 |
| 外汇 | 国家外汇管理局统计数据 | https://www.safe.gov.cn/safe/tjsj1/index.html | 外储、汇率、国际收支、结售汇、跨境收支 |
| 商贸 | 商务部商务数据中心 | https://data.mofcom.gov.cn/index.shtml | 国内贸易、外资、ODI、服务贸易、商品市场 |
| 政府采购 | 中国政府采购网 | https://www.ccgp.gov.cn/xxgg/ | 采购公告、中标公告、预算金额、供应商、采购人 |
| 招投标 | 全国公共资源交易平台 | https://www.ggzy.gov.cn/ | 工程建设、政府采购、土地矿权、产权交易 |
| 信用风控 | 信用中国 | https://www.creditchina.gov.cn/ | 行政处罚、失信、信用承诺、信用信息公示 |
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 知识产权 | 专利检索及分析系统介绍 | https://www.cnipa.gov.cn/art/2023/2/13/art_3166_182074.html | 专利检索入口说明、技术路线和竞品研发趋势线索 |
| 医疗器械 | NMPA 医疗器械 UDI 数据共享 | https://udi.nmpa.gov.cn/toDetail.html?CatalogId=3&infoId=40 | 只用页面查询/数据下载；不要申请或使用接口授权码 |
| 医保 | 国家医保局 | https://www.nhsa.gov.cn/ | 医保目录、集采、支付标准、医保政策 |
| 农业 | 农业农村部数据平台 | https://data.moa.gov.cn/ | 农产品价格、农业生产、畜牧、水产、市场监测 |
| 交通物流 | 交通运输部数据 | https://www.mot.gov.cn/shuju/ | 货运、客运、港口吞吐量、公路水路运输 |
| 快递物流 | 国家邮政局 | https://www.spb.gov.cn/ | 快递业务量、业务收入、区域结构 |
| 民航 | 中国民航局 | https://www.caac.gov.cn/ | 旅客吞吐量、货邮吞吐量、航班、机场统计 |
The module docstring states this is a "China official free/no-key market research API helper," and the CLI description similarly fixes the skill to China-specific APIs. This imposes a locale-specific scope in natural language without offering a user choice or opt-in, which matches the language/locale policy concern.
No suspicious patterns detected.