Security audit
Security checks for vulnerabilities and agentic risk
The skill is not malicious, but it asks the agent to run recurring internet-learning tasks and persist local knowledge files without clear user control or stop conditions.
Review this skill before installing if you do not want an agent to perform scheduled internet searches or maintain local tender-learning files. Use it in a user-triggered workflow, or require confirmation for each run and for any writes to the memory/tender-learning/ and tender-knowledge-framework/ directories.
The entire skill description and reporting template are written exclusively in Chinese, and there is no statement offering users a language choice or explaining that the skill is intentionally limited to Chinese-speaking or China-specific users. Under the language/locale policy, a skill should not implicitly force a specific language without opt-in or clear justification.
This markdown file contains user-facing instructional content only in Chinese and does not state that the skill is intended exclusively for Chinese-speaking users or a China-specific procurement context. Under the language/locale policy, forcing a single language without user opt-in or justification is a natural-language policy concern.
The template is entirely written in Chinese and the closing note indicates the report is automatically generated by the skill, which implies the skill produces output in a fixed language. Under the policy rules, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
The entire skill file is presented in Chinese and does not mention whether the user can choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern unless the locale constraint is explicitly documented and justified.
The file explicitly states that the skill will create or update files under memory/tender-learning/ and tender-knowledge-framework/, which affects local user/project data. The markdown does not include any warning, confirmation note, or disclosure that these files will be written as part of the task.
