Security audit
Security checks for vulnerabilities and agentic risk
The skill is not malicious, but its pharmacoeconomic analysis tooling is presented as production-ready while some advertised calculations are incomplete or potentially misleading.
Review this skill carefully before using it for real HTA, reimbursement, medical, or business decisions. Treat the included scripts as educational scaffolding unless you independently validate the formulas, dependencies, parameters, and model outputs against current authoritative guidance and your own test cases.
The description states the skill follows the China pharmacoeconomic evaluation guideline, and the document is entirely written for a China-specific context. Because the skill does not offer any language or locale choice, this creates a natural-language locale constraint that could violate policy for skills expected to support broader users unless explicitly opt-in.
This plain-text manifest includes a natural-language statement, "多语言支持仅限中文" (multilingual support limited to Chinese), which indicates a forced language/locale constraint. Under the policy, locale restrictions should either be optional for the user or clearly justified as region-specific; this file provides neither.
The file’s headings, instructions, and examples are all presented only in Chinese, and there is no indication that users may choose another language or that the skill is restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown file presents all instructions, examples, and checklists exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
The manifest and overview state that the skill should be used to write pharmacoeconomic reports according to Chinese guidelines and that it follows the latest Chinese pharmacoeconomic evaluation guidance. This imposes a specific locale/jurisdictional framework by default, with no indication that users can opt for other countries' standards or choose a different locale.
This code file contains natural-language text that effectively fixes the user-facing experience to Chinese, including the title and later printed report strings. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified.
The markov_model_transition function advertises cumulative costs and QALYs but hard-codes both to zero for every cycle, producing misleading outputs that could be consumed as if they were valid economic results. In a pharmacoeconomic evaluation skill, this can materially distort HTA analyses, reimbursement submissions, or treatment value assessments, making it a substantive integrity flaw rather than a harmless placeholder.
This Python file contains natural-language instructions and descriptions exclusively in Chinese, including the module docstring and later printed output, but it does not indicate that the skill is region-specific or provide any user opt-in for language/locale. Under the policy, forcing a specific language without user choice is a natural-language policy concern.
This code file contains natural-language titles and output strings in Chinese, such as the module description and later report text, but provides no indication that users can opt into another language. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified.
This markdown document is entirely written in Chinese and does not indicate that the language choice is optional or tied to a documented region-specific requirement. Under the policy rule, forcing a specific language without user opt-in can be a natural-language locale violation.
The file’s descriptive text, docstrings, parameter explanations, and user-facing output are predominantly in Chinese, with only a brief English subtitle. This imposes a specific language on users without any opt-in or documented locale choice, which matches the language/locale policy concern for natural-language content.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
pd.DataFrame: 敏感性分析结果
"""
# 保存原始值
original_value = getattr(self, parameter)
results = []
No suspicious patterns detected.