Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local Chinese-language export accounting checker that reads user-provided worksheet files and prints findings without network use, file writes, credentials, or persistence.
Install only if you are comfortable using a Chinese-language local checker for exported text worksheets. Treat its findings as review support, not as tax, customs, banking, audit, or legal approval; review the listed checks_not_run and sub_checks_not_run before relying on a clean result.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
The static finding indicates the package may only implement waybill/POD/COD checks while presenting itself as a broad 14-area export-audit tool. In this context, false completeness is dangerous because operators may use it as a gate before filing, reimbursement, or reconciliation decisions.
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单对象样例（内置）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单对象样例（内置）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单对象样例（内置）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单对象样例（内置）
The file’s natural-language documentation, interface examples, status messages, and expected section titles are written exclusively in Chinese, indicating the skill is intended to operate in a fixed language/locale. The policy allows locale constraints only when explicitly documented and justified as region-specific; this file does not clearly state that Chinese is a required locale constraint or offer any user language choice.
The file’s natural-language comments, examples, labels, advice strings, and user-facing disclaimer are entirely in Chinese, including the stated usage guidance and required input instructions. There is no indication that the skill supports other languages, offers locale choice, or documents a justified region-specific restriction, which can violate language/locale policy for general-purpose skills.
The file’s user-facing documentation and messages are entirely in Chinese, including the main description, warnings, and operational guidance. There is no indication that users may choose another language or that the locale restriction is optional or justified as a region-specific requirement.
This JavaScript file contains natural-language comments, sample text, field labels, advice, and result notes entirely in Chinese, and the parser requires Chinese column names to be recognized. There is no indication that the user can choose another language or locale, which fits the policy category for forced language/locale behavior without opt-in.
The file’s user-facing natural-language documentation and messages are entirely in Chinese, and there is no indication that the skill supports other languages or that Chinese is a required locale chosen by the user. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.
The file’s natural-language documentation and all user-facing guidance are written in Chinese, and later user-facing messages returned by the skill are also Chinese-only. There is no indication that the skill offers a language choice or documents a justified locale restriction, which can violate language/locale policy requirements.
The advice, insufficiency messages, summary basis text, and success note returned at runtime are all hardcoded in Chinese. Because the skill does not provide an opt-in locale mechanism or alternative language output, it enforces a specific language on users.
The file’s natural-language instructions, labels, advice, and expected inputs are entirely in Chinese, including the contract text and required column names. There is no indication that users may choose another language or that the locale restriction is explicitly documented as a region-specific requirement, which matches the language/locale policy violation criteria.