Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese financial privacy compliance checklist tool that only writes reports when the user asks it to.
Install only if you want a Chinese-language tool for China financial PIPL/JR/T compliance self-checks. Treat results as a checklist, not legal advice, and choose output paths carefully because an existing file at that path could be overwritten.
This markdown file presents all user-facing policy and usage terms exclusively in Chinese. Under the policy-violation category, forcing a specific language without user opt-in is a natural-language locale/language constraint that should be disclosed or made optional.
The skill advertises local execution and shows commands that can generate output files, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch can let the runtime infer broader file-write capability than users or policy reviewers expect, increasing the risk of unintended filesystem modification or overwriting local files.
The skill description and all user-facing guidance are written entirely in Chinese, with no indication that users may choose another language. The policy requires flagging language or locale constraints when a skill effectively forces a specific language without opt-in or justification.
The package metadata uses Chinese-only natural language in the description and keywords, which can effectively force a specific language/locale for discovery and understanding without stating that the skill is CN-only or offering an alternative language option. The file does include a region value of "cn", but it does not explicitly document that the language restriction is intentional or user-facing.
The generated HTML explicitly fixes the document language to "zh-CN", and the surrounding UI/report strings are all hard-coded in Chinese. This enforces a specific language/locale for users without offering any configuration or opt-in, which matches the policy category for language/locale constraints.
Lines L05-L10 present all substantive skill information exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this file does not indicate any alternative language support or explicit locale justification.
The README presents all user-facing instructions and descriptions in Chinese only, which can constitute a language/locale policy issue when no user opt-in or alternative language option is provided. There is no indication that the skill explicitly offers multilingual support or that the Chinese-only constraint is intentionally presented as an opt-in choice.
The natural-language description includes only Chinese text for the module purpose, which can indicate a fixed language/locale assumption. There is no nearby indication that users may choose another language or that the Chinese-only wording is required for a region-specific compliance context.
