Security audit
Security checks for vulnerabilities and agentic risk
This is a small personal finance skill with disclosed local storage and no bundled executable or hidden behavior in the inspected artifact.
Before installing, confirm you are comfortable storing income, expense, and budget data in local JSON files under ~/.memory/finance, and only run the referenced Python script if it comes from a source you trust because it was not included in this artifact.
The natural-language description, headings, and usage guidance are presented in Chinese, which can impose a language constraint on users without any explicit opt-in or justification. Per the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale limitation is documented and justified.
The skill explicitly stores financial records and budget data in persistent local files under the user's home directory, but the description does not warn users about this persistence. For a finance-related skill, silent storage of sensitive spending and income data can create privacy and data-retention risks if users assume the data is ephemeral.
No suspicious patterns detected.
