📦
Audit History
data-circulation-institution-expert - 1 audit
Audit version 1 Latest
Sep 27, 2026, 03:23 AM
All twelve static findings are false positives: they are Markdown formatting, documentation paths, author URLs, or entropy heuristics triggered by readable Chinese text. No prompt injection, executable command, home-directory access, or network-exfiltration behavior was found. The bundled regulatory guidance should be independently verified before it is used for compliance or credential decisions.
4
Files scanned
404
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Regulatory Claims Need Independent Verification
The knowledge base presents a named 2026 policy as a core authority and gives qualification guidance. Users could rely on material that may change or require jurisdiction-specific interpretation.
The cited lines make regulatory and qualification claims, while the bundled material does not provide primary-source links or validation dates beyond its stated baseline. The skill does state that it does not replace licensed institutions or regulators, which reduces but does not remove the risk.
Risk Factors
📁 Filesystem access (2)
⚙️ External commands (3)
🌐 Network access (2)
Audited by: claude