Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local EU AI Act compliance navigator, with no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Install only if you are comfortable with a simple local compliance aid that is not legal advice. Expect Chinese-first CLI output and verify EU AI Act conclusions against official or legal sources before relying on them.
The file presents the skill's operational description and agent instructions entirely in Chinese, including triggers and rules of engagement. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this file does not provide an alternative language option or explain a required Chinese-only scope.
This markdown file includes policy-relevant instructions and licensing text primarily in Chinese, including imperative language such as '务必并读' and a required disclosure block, without stating that users may choose their preferred language. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy violation.
The file presents the primary display name and core description in Chinese, and the usage conditions are also written in Chinese. This can impose a specific language/locale on users without any explicit opt-in or language-selection mechanism, which matches the policy category for language/locale constraints.
The module docstring, CLI help text, and output strings are primarily in Chinese, and the skill does not state that language selection is optional or configurable. This can violate a language/locale policy when users are forced into a specific language without opt-in.
The interface metadata declares a specific entry point at scripts/eu_ai_act_nav.py (L036), while the English usage text says it runs the Python logic in eu_ai_act_nav.py (L072) and the Chinese section similarly references eu_ai_act_nav.py (L092). This is a documentation-to-implementation inconsistency, though minor and not clearly security-impacting.
