Compliance Security Check Skill (Jinyiwei)
Usage
- Invoked by the Jinyiwei Worker when a file/URL is received, serving as the first gate of the pipeline.
- Outputs a structured verdict (
pass / reject), and writes provenance to be recorded by the Taishige for traceability.
Input
target: the object to be inspected, choose one of two
- Local file path (PDF / PPT / Excel / Word / image)
- External URL (domain must be resolved first)
policy_ref: (optional) reference to a compliance rule set that overrides the default policy
Output
verdict：pass or rejectreport: security scan report, including hit blacklist items, license status, and risk leveltrace_id: provenance tracking ID of this scan (used for Taishige traceability)
Dependencies
- Blacklist of known non-compliant domains such as Sci-Hub (local CSV/JSON)
- OA document license verification library (local rules)
- File type detection (
python-magic）
Failure Handling
- Scan service unavailable:reject the file and raise an alert, never degrade to allow-through (zero-trust baseline).
- File type unrecognizable: mark
reject and write the reason, leaving it to the administrator to confirm.
- Blacklist library read failure: fall back to the conservative strategy of "reject all + alert," and prompt operations to fix it.
Reuse Value
- Decoupled from specific business logic: any document processing system (RAG, knowledge base, contract review) can directly mount this Skill as an entry-point security check.
- Configurable verdict criteria: by replacing
policy_ref , it adapts to the compliance baselines of different industries.
Final-round code package execution (runnable package)
- Real entry point:
scripts/run_security_scan.py
- Execution is equivalent to
core.runtime.AgentSession.run_stage("security-scan"), calling security.jinyiwei.JinYiWeiAgent(pure Python, zero external dependencies, can run offline).
- Run:
python skills/security-scan/scripts/run_security_scan.py
- Artifacts:
examples/snse_survey/skill_outputs/security_scan.json(yellow card + scan report).
