Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local Chinese-language budget table checker that reads user-provided table text and reports deterministic arithmetic issues without network use or persistence.
Install this only if you want a local checker for Chinese budget execution tables. It does not send data over the network, but it is not a full audit tool: review the disclosed free-version checks and the withheld checks before relying on the output for month-end or management decisions.
The skill’s documentation appears to overstate what the free version actually verifies, including broad claims like line-by-line checking and quoting original source evidence for every conclusion. In a finance workflow, users may rely on these claims to approve reconciliations or close books, so capability inflation can cause missed discrepancies and incorrect business decisions even without malicious code execution.
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
The file’s user-facing comments, guidance, labels, error messages, and disclaimer are all written exclusively in Chinese, indicating the skill is designed to operate in a single language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
The main user-facing instructions and operational guidance in the markdown body are entirely in Chinese, while the file does not state that the skill is restricted to Chinese-speaking users or offer a language choice. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
The comment says non-JSON input is treated as plain-text material such as '直接粘贴的合同全文', which contradicts the surrounding manifest and help text that define the skill as a budget execution table checker requiring table headers. This is an active documentation mismatch because it describes a different document type than the code's stated purpose and user guidance.
The JSON content consists entirely of Chinese-language text and provides no indication that language selection is optional or justified by a region-specific purpose. Under the policy, fixed language/locale behavior without user opt-in can be a natural-language policy violation.