Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple local CSV analysis and cleaning tool with some documentation overclaims but no evidence of hidden, destructive, credential-seeking, or network behavior.
Before installing, treat this as a basic CSV-only local analysis utility, not the full-featured Excel/chart/PDF service described in the README. Run it only on data you intend to analyze, and note that it writes report or cleaned-data files into its local output directory.
The descriptive and instructional content is presented in Chinese only, with no indication that users may choose another language. Under SQP-3, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
This markdown file documents writing analysis outputs such as report.md and charts/, and also advertises export features, but it does not include any warning that running the skill may create or overwrite local files. For markdown files, SQP-2 applies when behaviors affecting user data or system integrity are described without disclosure.
The function signature and CLI help indicate that callers can provide an analysis_type for analyze, implying different analysis behaviors may be selected. In practice, analysis_type is accepted at L13 and passed from the CLI at L76-L77, but never used; the code always generates the same overview and summary statistics report.
This code file contains natural-language strings in Chinese ("分析CSV文件" and "清洗数据") while the rest of the user-facing interface is in English. That creates an implicit language constraint without user opt-in or justification, which matches the language/locale policy violation criteria.
The package description includes Chinese text alongside English, which implies a specific language/localization choice without any indication that users can opt into their preferred language. Under the policy, language constraints should either offer a choice or be clearly justified as region-specific.
No suspicious patterns detected.
