Security audit
Security checks for vulnerabilities and agentic risk
This is a finance/accounting guidance skill with sensitive but purpose-aligned workflows and no code, network access, persistence, or hidden behavior.
Install only if you want Chinese-language accounting and spreadsheet assistance. Because the workflows can involve tax IDs, bank statements, invoices, and ledgers, redact or mask unnecessary sensitive data and confirm before allowing changes to production financial records.
The skill is designed for accounting, tax, invoice, bank reconciliation, and financial reporting, all of which commonly involve highly sensitive business and personal data. Without an explicit warning or data-handling notice, users may provide tax IDs, bank details, invoice numbers, or confidential ledgers without understanding the sensitivity or minimizing disclosure.
The skill activates on essentially any finance or accounting request, creating a high chance of over-triggering in contexts where the user did not intend to invoke this specialized workflow. In a domain involving sensitive financial, tax, invoice, and banking data, broad activation increases the risk of unnecessary exposure of confidential information and inappropriate automation guidance.
Several trigger phrases in the Excel automation section are overly generic, such as requests to fill forms, generate reports, summarize data, or automate calculations. These phrases can match many unrelated user intents and may cause the skill to engage on sensitive spreadsheets or financial records without sufficient certainty or consent.
The manifest description, trigger phrases, templates, and workflow instructions are presented entirely in Chinese, with no indication that users may choose another language. Under the stated policy, a fixed language without opt-in can be a natural-language locale violation unless explicitly justified.
