Security audit
Security checks for vulnerabilities and agentic risk
This skill contains no executable code, but it gives detailed workflows for off-book public-company accounting, personal-card business payments, and internal/external ledger differences that users should review carefully before installing.
Install only after finance, tax, legal, or compliance review. This skill should not be used to run off-book ledgers, route company funds through personal accounts, conceal uninvoiced revenue or expenses, or normalize kickbacks/commissions; any discrepancy analysis should be used to correct and escalate issues in official records.
The natural-language description states the skill is for Chinese-speaking internal accounting workflows, and the trigger set is overwhelmingly Chinese-language, with no indication that users may choose another language or locale. This can violate language-choice policy when a skill implicitly requires a specific language without opt-in or explicit justification.
The trigger list includes broad terms such as internal accounting, profit analysis, receivables/payables, and Excel reporting that may cause the skill to activate in contexts far beyond its intended niche. Because the skill contains sensitive guidance around off-books and private-account handling, overbroad invocation increases the chance of surfacing risky instructions to users who did not explicitly request them.
This section explicitly normalizes handling of uninvoiced expenses, kickbacks/commissions, and private advances in an 'internal accounts' workflow. In the context of a listed-company accounting skill, such guidance can facilitate concealment of non-compliant transactions, bribery-related payments, or tax evasion by operationalizing how to record them outside standard controls.
The skill provides concrete templates and accounting treatment for routing business receipts and payments through a boss's personal bank card. This is dangerous because it enables commingling of corporate and personal funds, undermines auditability and internal controls, and can be used to hide transactions from regulated books, tax reporting, or anti-corruption oversight.
This module goes beyond neutral reconciliation and teaches users how to manage persistent internal/external ledger differences arising from uninvoiced income, private spending, commissions, and personal-card receipts. In practice, this can help institutionalize dual-bookkeeping and concealment of irregular transactions, which is especially risky for a public-company setting with strict reporting, tax, and anti-fraud obligations.
