Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed local bias-audit helper that reads user-provided text or a chosen file and reports stereotype or fairness signals, with no evidence of hidden network access, persistence, credential use, or destructive behavior.
Install this if you want a lightweight local bias-audit checklist for text. Be aware that the script output and some documentation are Chinese-heavy, and the skill may trigger on broad fairness/content-review wording; review results as heuristic suggestions rather than as a certified compliance decision.
The text states the full procedure is "English-first, Chinese-after," which is a natural-language locale policy baked into the skill description rather than a user-selected option. This can violate language-choice policy because it prescribes output ordering without offering opt-in or alternatives.
The trigger phrase list is broad enough to activate on generic review or content-audit requests that are not clearly scoped to bias analysis. In an agentic system, overbroad activation can cause the wrong skill to take control, read or write files, and steer workflows based on an unintended fairness-review frame, creating prompt-routing and least-privilege failures.
The English activation guidance relies on ambiguous conditions like questioning bias or fairness review without defining boundaries, confidence thresholds, or exclusions. This increases the chance of unintended invocation and context misclassification, especially because the skill instructs loading a local script and has file read/write permissions.
The Chinese activation guidance includes broad wording such as fairness-check and bias-detection trigger phrases that can match many normal moderation, compliance, or editing requests. In this skill context, accidental invocation is more concerning because the workflow explicitly directs the agent to load and execute a local script, magnifying the effect of misrouting.
The module docstring is written as an instruction/specification entirely in Chinese and frames the skill’s behavior in that language, with no indication that other languages are supported or that users can opt in to Chinese. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific.
