Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese legal-document drafting skill that requests sensitive case details for a disclosed purpose and does not run code or access data on its own.
Install only if you want help drafting Chinese civil complaint materials. Expect it to ask for names, addresses, contact details, case facts, and evidence information; provide only what is necessary, redact nonessential third-party or identifier details, and have any generated filing reviewed against local court requirements or by a qualified legal professional.
The entire skill description and output expectations are specified only in Chinese and assume Chinese legal-document drafting conventions, with no statement that this locale is optional or limited to Chinese-language use cases. Under the policy, a language or locale constraint should either be optional for the user or explicitly documented as justified.
The trigger condition includes broad phrases like "打官司" and a keyword list ending with "等关键词", which makes the activation scope unclear and likely to overlap with general discussion of legal problems rather than a specific request to draft a complaint. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
The skill instructs collection of highly sensitive personal and legal-case data, including identity, address, contact details, and evidence metadata, without an explicit upfront privacy warning, minimization guidance, or consent checkpoint. In a legal context this increases the risk of oversharing, unnecessary retention, and exposure of sensitive litigant or third-party information.
The manifest and task goal describe the skill as extracting case facts and evidence to generate a规范的民事起诉状, which is specifically a civil complaint. However, the usage example for a labor dispute says the agent will generate a 仲裁申请书, a different legal document and procedure from a civil complaint. This expands the documented behavior beyond the declared scope.
The template explicitly requests highly sensitive personal data for plaintiffs and defendants, including birth date, home address, employer/work unit, and contact information, but provides no privacy, minimization, redaction, or filing-risk guidance. In a legal-document drafting context, this can lead users or downstream systems to over-collect and unnecessarily expose personal data in shared chats, generated drafts, or court filings.
SQP-3 applies to all file types and includes language or locale policy violations. This file uses only Chinese throughout and does not provide any opt-in, alternative language option, or justification that the skill is limited to a Chinese-language audience.
No suspicious patterns detected.
