Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local fixed-asset depreciation checker whose behavior matches its stated purpose and does not show hidden network, persistence, credential, or destructive behavior.
Install only if you need a Chinese-language local checker for fixed-asset depreciation ledger arithmetic. It reads the input file you provide and runs locally, but it is not an accounting, audit, tax, policy, or physical asset verification tool.
虽然声明中的一部分能力与代码相符，例如逐项算术检查、合计勾稽、重复与空缺检测、引用原文行号，但代码的核心用途明显更窄且不同：它专门核对固定资产折旧表，而不是一般意义上的固定资产台账。代码依赖折旧专属字段，并按直线法公式复核月折旧、累计折旧、净值，这属于比描述更具体且不同的主功能定位。若用户依据描述提供普通台账而非折旧明细，代码可能无法工作或只能部分工作。因此应判定为描述与实际行为存在实质性不匹配。
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
The file’s natural-language instructions and descriptions are entirely in Chinese, including the usage contract and scope notes. This imposes a language choice on users or maintainers without any opt-in or documented locale constraint, which matches the language/locale policy-violation category.
The comment says non-JSON input is treated as plain-text material such as '直接粘贴的合同全文', which describes contract-document processing rather than fixed-asset ledger checking. Surrounding usage text and manifest consistently state the tool is for fixed-asset ledger input with headers, so this inline documentation misstates the skill's intended input domain.