Security audit
Security checks for vulnerabilities and agentic risk
This is a simple local compliance checklist skill with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.
Install only if you need a China data export compliance pre-screening checklist. Treat its output as an aid, not legal advice or regulatory certification, and review the stale hash/provenance metadata and broad allowed-tools declaration before relying on it in controlled environments.
The file's natural-language instructions are entirely in Chinese, including operational guidance for AI agents and maintainers. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
The natural-language description mixes English with untranslated Chinese terms and frames the skill around a China-specific compliance domain without stating any user language or locale selection mechanism. Under the policy, forcing or assuming a specific language/locale without opt-in can be a natural-language policy concern.
The changelog states a 'Bilingual rewrite (full EN+ZH, English first)', but the manifest title, display name, primary description field, and most metadata remain Chinese-first elsewhere in the file. This creates a natural-language locale preference without any stated user choice or opt-in mechanism.
The core description at L003/L017-L018 says the skill performs a five-obligation self-check where any missing item results in FAIL. However, L070 states the output includes an 'overall compliance score,' which implies graded scoring rather than the binary fail-on-missing behavior described elsewhere. This is an intent/documentation contradiction rather than a mere omission.
The manifest repeatedly states that the check is based on five obligations and that any missing item yields FAIL. L091 instead says the returned result includes a '综合合规评分' (composite compliance score), which contradicts the explicitly stated binary gating model. Because this is a direct mismatch in the skill's own documentation, it fits intent-code/documentation divergence.
The natural-language content in this file is entirely in Chinese and presents the skill description and guidance in that language only. Under the stated policy, a language or locale constraint should not be imposed unless the skill offers a user choice or clearly documents and justifies the restriction.
This file contains user-facing strings entirely in Chinese, including checklist items, argument descriptions, and final status messages. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
