security-scan

Compliance Security Check Skill (Jinyiwei)

Usage

• Invoked by the Jinyiwei Worker upon receiving a file/URL, serving as the first gate of the pipeline.
• Outputs a structured verdict (pass / reject), and writes provenance to be recorded by Taishige.

Input

• target: object to be checked, choose one of two
  • Local file path (PDF / PPT / Excel / Word / image)
  • External URL (domain must be resolved first)
• policy_ref: (optional) reference to a compliance rule set that overrides the default policy

Output

• verdict：pass or reject
• report: security scan report, including hit blacklist items, license status, and risk level
• trace_id: provenance tracking ID for this scan (used by Taishige for recording)

Dependencies

• Blacklist of known violating domains such as Sci-Hub (local CSV/JSON)
• OA document license verification library (local rules)
• File type detection (python-magic）

Failure Handling

• Scan service unavailable:reject the file and raise an alert, never downgrade to allow (zero-trust bottom line).
• File type unrecognizable: mark reject and write the reason, leaving it to the administrator for confirmation.
• Blacklist library read failure: fall back to the conservative "reject all + alert" strategy, and prompt operations to fix it.

Reuse Value

• Decoupled from specific business logic: any document processing system (RAG, knowledge base, contract review) can directly mount this Skill as an entry security check.
• Verdict criteria are configurable: by replacing policy_ref to adapt to compliance baselines of different industries.

Finals code package execution (runnable package)

• Real entry point:scripts/run_security_scan.py
• Execution is equivalent to core.runtime.AgentSession.run_stage("security-scan"), calling security.jinyiwei.JinYiWeiAgent(pure Python, zero external dependencies, can run offline).
• Run:python skills/security-scan/scripts/run_security_scan.py
• Artifacts:examples/snse_survey/skill_outputs/security_scan.json(yellow card + scan report).