Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language customs and export-compliance reference skill with no executable code, hidden data access, persistence, or automatic account actions.
Install only if you want Chinese-language export and customs compliance guidance. Treat its regulatory answers as a starting point and confirm current requirements with official authorities, a testing lab, platform policy, or a customs broker before filing registrations, changing labels, or shipping goods.
The natural-language content, examples, and warnings are all presented only in Chinese, which effectively forces a specific language for users. The policy allows fixed locale/language only when there is user opt-in or a clearly justified region-specific constraint, neither of which is stated here.
The trigger phrase '产品认证哪里办' is highly ambiguous and could refer to many unrelated certification workflows outside cross-border export compliance. Because the skill provides jurisdiction-specific legal/compliance guidance, accidental activation on vague certification questions can misroute users and produce incorrect or incomplete advice.
The trigger list contains broad phrases like '清关需要什么文件', '怎么避免海关扣货', and similar generic requests that can match a wide range of ordinary logistics/compliance conversations. This increases unintended invocation risk, causing the skill to activate in contexts where the user did not explicitly request this tool, which can lead to irrelevant or overconfident regulatory guidance being surfaced.
The example output specifies "日语标签 + 原产地" as a requirement in natural language, which imposes a specific language/locale without any opt-in framing or explanation of whether it is legally required for the given product context. Under the policy, forced language constraints should be clearly justified or presented as jurisdiction-specific requirements.
The JSON uses a Chinese-language value for "productCategory" ("电子产品") while the rest of the file is locale-neutral, which indicates a forced language choice in skill data. The policy requires either user opt-in for language/locale constraints or clear documentation that the file is intentionally region-specific.
The status enum is restricted to Chinese-language values only (合规良好, 需改进, 需重点关注). For a general-purpose schema, this hard-codes a locale-specific output format without offering a language choice or documenting a justified regional constraint, which matches the language/locale policy concern.
The markdown repeatedly states that labels or packaging "must" be in specific languages such as English, German, Estonian, Japanese, or Chinese/English. Under the policy rule for natural-language content, this is a language/locale constraint presented as mandatory without offering user choice or clarifying that the requirement is jurisdiction-specific compliance guidance.
The phrase 'CE认证是什么' is educational and very broad compared with the skill's narrower export-certification and customs-check workflow. On its own, it may invoke the skill for generic explanatory queries, creating a mismatch between user intent and tool scope and increasing the chance of unnecessarily specific or jurisdiction-assumptive compliance output.
The productCategory enum mixes Chinese and English values and includes Chinese-only options such as "母婴", "电子产品", and "其他". This imposes language-specific input expectations in the schema without any visible opt-in, locale selection mechanism, or documented justification for the language constraint.
This JSON response presents user-facing content entirely in Chinese, including status and action descriptions, with no indication that the language is user-selectable or tied to a documented regional requirement. That can violate a language/locale policy when users are not given opt-in or choice.
