Security audit
Security checks for vulnerabilities and agentic risk
This is a local offline medical-device checklist helper, not a credentialed or networked tool, but its outputs still need human regulatory review.
Install only if you need this specific medical-device test-item and lab-scope screening workflow. Treat results as a starting checklist, verify current official standards and lab accreditation manually, and constrain agent use to running the local Python script rather than granting unnecessary WebFetch or Write authority.
The title and document content are written in Chinese and present the skill instructions in that language, but the file does not offer an alternative language choice or state that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The trigger list includes very broad domain terms such as general medical-device and compliance language, which can cause the skill to activate outside its narrowly intended use case. In an agent setting, ambiguous activation can route unrelated user requests into a compliance-oriented tool, producing misleading outputs or unnecessary file/script execution without clear user intent.
The English trigger description uses generic phrases like 'medical device' and 'medtech compliance' without concrete activation constraints. This increases the chance of accidental invocation in broader regulatory or product discussions, which is risky because the skill performs deterministic screening that may be mistaken as applicable advice in contexts it was not designed for.
The Chinese trigger section repeats broad generic terms that are common across many medical-device compliance conversations, making reliable activation difficult. In a high-stakes compliance domain, overbroad triggering can surface the tool in unsuitable contexts and lead users or agents to rely on incomplete, out-of-scope screening results.
The file-level docstring presents the skill entirely in Chinese, and no natural-language text indicates that users can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified as region-specific.
The argument help strings are all user-facing natural language and are provided only in Chinese, with no mechanism for users to select a different language. This can amount to a language policy violation because the skill imposes a locale-specific interface without explicit opt-in or justification.
The CLI description shown to end users is only in Chinese and does not state that the tool is limited to a China-specific regulatory audience. Because the policy allows locale constraints only when documented and justified, this user-facing text should clarify the intended locale or offer language choice.
This file contains user-facing text entirely in Chinese, including the title and labels, with no indication that the skill offers a language choice or that the locale restriction is intentional and justified. Under the policy, fixed-language presentation without user opt-in can be a natural-language policy violation.
The primary descriptive text is presented entirely in Chinese, with no indication that users may choose another language or that the skill is restricted to a Chinese-language audience. Under the policy, a language or locale constraint should be opt-in or clearly justified.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"rc": 2, "error_code": e.code}, ensure_ascii=False))
sys.exit(0 if ok else 2)
args = {k: getattr(ns, k) for k in names}
if not any(v not in (None, "") for v in args.values()):
p.print_help()
sys.exit(0)
No suspicious patterns detected.