Security audit
Security checks for vulnerabilities and agentic risk
This is a finance-analysis instruction skill with disclosed file-reading and web-search expectations, and I found no hidden code, persistence, exfiltration, or destructive behavior.
Install only if you want a Chinese-first finance-analysis workflow. Use it with public reports or files you are allowed to process, and be careful before asking it to combine confidential company data with web searches or generated reports.
The skill name, description, triggers, output conventions, and notes are all written as Chinese-first instructions, and the formatting rules prescribe Chinese units and date presentation without any opt-in or alternative language path. This is a natural-language locale policy concern because the skill implicitly forces a specific language/locale rather than offering user choice.
The trigger list contains many generic finance phrases such as requests to analyze reports, assess company finances, or generate summaries. In an agent environment, overly broad triggers can cause unintended activation on ordinary user conversations, which may lead the skill to read files, initiate searches, or produce sensitive financial analyses without the user explicitly opting into this higher-impact workflow.
The skill declares capabilities to read local financial files, perform network searches, and generate reports, but it does not clearly disclose how potentially sensitive corporate data will be handled. Because this skill is designed for due diligence, budgeting, and financial analysis, accidental processing or external transmission of non-public financial information is more dangerous than in a generic skill.
