Security audit
Security checks for vulnerabilities and agentic risk
This is a purpose-aligned ISO 14971 risk-matrix CLI skill with limited, disclosed behavior and no evidence of hidden network, persistence, credential, or destructive activity.
Installers should treat the 5x5 matrix and keyword checker as aids only: the skill itself says the manufacturer’s risk-management plan controls acceptability, keyword hits do not prove compliance, and check mode only supports English and Chinese documents. Use it on files you intentionally provide for review.
This markdown file is primarily written in Chinese and directs both AI agents and human maintainers to follow its instructions, but it does not offer an alternative language or indicate that Chinese is optional. Under the policy rule for natural-language violations, this creates a locale/language constraint without explicit user opt-in or justification.
The natural-language note says the keyword-based check supports only Chinese and English. Under the policy, forcing a language/locale constraint without user opt-in or a clearly documented justification is a reportable issue; this line gives the limitation but does not present it as an optional mode or explain why only these languages are permitted.
The manifest sets category: 医疗器械合规 in Chinese while the skill is otherwise presented bilingually. This may impose a locale-specific label without documenting a user language preference or a justified region-specific constraint.
The line lists trigger terms such as “风险矩阵” and “风险管理文件自查”, which are relevant but still broad enough to overlap with general discussion of risk management rather than a clear invocation boundary. The file does not pair these trigger phrases with negative examples or explicit constraints on when the skill should not activate.
Lines L5-L8 present key skill metadata only in Chinese, which imposes a specific language/locale on readers and agents without offering an alternative or opt-in. The file does not document a region-specific reason for this language restriction, so it creates a natural-language policy concern.
The user-facing labels and descriptions in the severity, probability, and band definitions are primarily in Chinese, and the rest of the script continues to print Chinese output. For a general-purpose CLI skill, this imposes a locale preference without any opt-in or configuration, which matches the language/locale policy concern.
No suspicious patterns detected.
