Security audit
Security checks for vulnerabilities and agentic risk
The skill is a narrowly scoped DRG/DIP catalogue reporting helper that clearly uses an external MedGroup MCP service and shows no hidden code, persistence, or destructive behavior.
Install this only if you intend to send DRG/DIP catalogue source files to the MedGroup service using your API key. Do not use it for patient-level, confidential, or unrelated documents unless you are authorized and comfortable with the external upload and report link workflow.
The manifest description and visible skill content are written entirely in Chinese and do not indicate that the user can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
The skill enables implicit invocation for a networked MCP tool without any visible trigger narrowing, exclusions, or user-confirmation constraints. This can cause the agent to call an external service and potentially transmit user-provided catalogue files or sensitive medical billing data unexpectedly, increasing the risk of unintended data disclosure and unsafe autonomous actions.
The entire protocol is written only in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the regional constraint is explicitly justified.
The display name, description, and default prompt are all written in Chinese, but the file does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-language audience. This may violate language/locale policy when users have not opted into that locale.
No suspicious patterns detected.
