Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese bidding-compliance keyword checker with some documentation mistakes, but no evidence of hidden access, persistence, network use, or malicious behavior.
Before installing, note that this tool is limited to Chinese PRC bidding/procurement compliance phrasing and uses simple keyword matching, so it can miss issues or flag harmless negations. Also be aware that the documented --file option is not implemented and the CLI help title has a wrong domain label.
The module docstring and manifest describe a 招投标合规护栏 that detects bidding-related violations, but the argparse description at L099 says "金融消保合规护栏检测内核". This is an active contradiction in user-facing documentation, not just an omission, and could cause developers or agents to invoke the skill under the wrong compliance context.
SQP-3 applies to all file types and covers natural-language policy violations such as forced language/locale or similar organizational-policy issues. Here the user-facing description at L099 says "金融消保合规护栏检测内核" while the file-level instructions and examples describe 招投标合规; this inconsistency can mislead users about the governing policy/domain and cause the wrong compliance framing to be applied without explicit choice or justification.
The module docstring and all user-facing labels, basis text, and remediation strings are written exclusively in Chinese, indicating the skill is designed to operate in a single language. The file does not state that the skill is China-specific or otherwise provide a user opt-in or language choice, so this creates a natural-language locale policy concern.
The file presents all user-facing natural language in Chinese, including the title and release notes, with no indication that the skill is optional for Chinese-speaking users only or that other language choices are available. Under the policy rule for language/locale constraints, this can be a violation unless the locale restriction is explicitly documented and justified.
The file presents the skill entirely in Chinese and describes it as governing bid-compliance against PRC laws, but does not explicitly state that the skill is intended only for Chinese-language / PRC procurement contexts or offer an opt-in language or locale choice. Under the policy rule, forcing a specific language or locale without user choice can be a natural-language policy concern unless the regional constraint is clearly documented and justified.
The manifest presents the display name and full user-facing description only in Chinese, which can amount to a language/locale constraint without explicit user opt-in. The file does not indicate that the skill is region-specific or offer an alternative language choice.
No suspicious patterns detected.
