Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-language advisory skill for comparing cross-border ecommerce company registration options, with no executable code or hidden persistence.
Use this as preliminary registration-planning guidance only. Before paying providers, filing company documents, applying for tax identifiers, opening bank accounts, or submitting BOI/VAT/trademark filings, confirm current official requirements and get qualified legal or tax advice; downstream agents should not execute these actions without explicit user approval.
The usage instructions tell the user to speak using Chinese example prompts only, and the document overall is written entirely in Chinese despite the skill title including English. There is no indication that other languages are supported or that the Chinese-only behavior is an intentional, justified regional constraint, which can violate language/locale choice policy.
The trigger list contains many generic business questions such as '注册流程是什么', '哪个国家注册最便宜', and 'XX和YY哪个好', which can match ordinary compliance, tax, or company-formation discussions outside this skill’s precise domain. Overbroad activation can cause the wrong skill to take control, leading users to receive jurisdiction-selection guidance when they may have intended a narrower legal, tax, or platform-policy question, increasing the chance of misleading compliance advice.
This JSON response uses Chinese natural-language strings for status, reasons, warnings, and action descriptions, but the file provides no indication that the user opted into Chinese or that the skill is region-specific. That creates a language/locale policy concern because the skill appears to force a specific language by default.
This JSON schema is a manifest/config-type file, so natural-language values embedded in it should comply with language policy expectations. The enum hardcodes output labels in Chinese only, which can force a specific language/locale on downstream users or tools without any documented opt-in or region-specific justification.
The title and the entire document content are presented in Chinese, with no indication that other languages are supported or that the user can choose a preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
The skill defines positive trigger examples but does not define explicit exclusion conditions, so adjacent intents like visa advice, local domestic incorporation, tax planning, marketplace account troubleshooting, or formal legal opinion requests may still activate it. In a compliance-oriented skill, unclear boundaries are risky because users may over-trust jurisdiction recommendations as authoritative advice in contexts the skill explicitly should not cover.
The JSON sets productCategory to the Chinese value 电子产品 while the rest of the file uses English-oriented fields and values. This can indicate a locale/language constraint embedded in the skill data without any documented user opt-in or justification, which matches the language/locale policy concern.
The natural-language description is written only in Chinese and specifies the skill's follow-up behavior without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.
No suspicious patterns detected.
