Security audit
Security checks for vulnerabilities and agentic risk
This skill is an interface-only memory/search/vector package and does not ship code that accesses data, runs commands, uses the network, or persists anything.
Install this as a low-risk interface package. Review the separate private implementation package before installing or using it, because that implementation is explicitly outside this artifact and may add network, storage, credential, or memory behavior not present here.
The file’s descriptive and warning text is presented in Chinese throughout, including the title, security note, and usage guidance. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is documented and justified.
The package description contains only Chinese text for key behavioral statements such as 'interface-only package' and 'implemented by private package.' This imposes a specific language/locale in user-facing metadata without offering a language choice or documenting why Chinese-only text is required.
The manifest description is written only in Chinese ("纯接口包，无运行时依赖"), which can impose a language-specific constraint on users without offering a language choice or documenting a justified locale limitation. The file provides no indication that this skill is region-specific or that non-Chinese users can opt in to this locale.
The file’s natural-language docstrings and comments are written entirely in Chinese, and there is no indication that the skill offers a language choice or that the interface is intentionally limited to a Chinese-speaking context. Under the policy rule for language/locale constraints, this can be treated as a forced locale in natural-language-facing skill materials.
This interface file uses Chinese throughout its natural-language docstrings and comments, with no indication that other languages are supported or that Chinese is an intentional opt-in choice. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.
This code file contains user-/developer-facing natural language exclusively in Chinese in the module docstring and interface documentation. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation, and no alternative language option or justification is provided here.
No suspicious patterns detected.
