Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local accrual-expense ledger checker whose code matches its stated purpose and does not show network, persistence, credential, or destructive behavior.
Install only if you are comfortable running a local Node script on ledger text you provide. The tool appears local and non-networked, but its findings cite rows and calculated values rather than preserving full original evidence excerpts.
总体上，代码的主要目的与描述大体一致：都是针对预提费用台账做内部勾稽检查，而且“免费版只执行免费检查项”的说法与实现吻合。代码也没有出现未声明的高风险能力，如联网、读写外部系统、调用额外资源等。主要不一致点在于描述声称“每条结论引用原文”，而实现仅基于解析后的行号、项目名和数值生成说明文本，没有把输入中的原文内容逐条引用出来，也没有证据链式摘录原单元格文本作为结论附件。因此存在描述与行为的不完全一致，属于能力表述上的实质性偏差，但偏差范围较窄。
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
Natural-language strings throughout the file, including comments describing usage and user-facing messages returned by the tool, are written exclusively in Chinese. This imposes a specific language/locale without any documented user choice or explicit justification that the skill is intended only for a Chinese-language context.
The inline documentation states that non-JSON input is handled as plain-text material, giving "直接粘贴的合同全文" as the example. That contradicts the skill's stated purpose and surrounding documentation, which consistently say the input should be an accrual-expense ledger with headers, not a full contract text.