Security audit
Security checks for vulnerabilities and agentic risk
This is a local accounting worksheet checker that reads user-provided files and prints results without network use, persistence, or hidden privilege behavior.
Install only if you are comfortable running a local Chinese-language accounting checker on exported worksheet text. Treat its output as arithmetic and consistency review, not audit, tax, or accounting judgment; pay attention to checks explicitly listed as not run, especially free-version withheld sub-checks.
If the tool actually runs a different set of checks, on different data structures, and without the claimed original-file line references, users can treat the results as contract-level verification when they are only table-level consistency checks. In an accounting-review context, that can cause silent control gaps: missing issues may be assumed checked, while unsupported findings may be treated as evidence.
If the tool actually runs a different set of checks, on different data structures, and without the claimed original-file line references, users can treat the results as contract-level verification when they are only table-level consistency checks. In an accounting-review context, that can cause silent control gaps: missing issues may be assumed checked, while unsupported findings may be treated as evidence.
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单合同样例（内置，2 项全跑）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单合同样例（内置，2 项全跑）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单合同样例（内置，2 项全跑）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单合同样例（内置，2 项全跑）
The file’s user-facing comments and instructions are entirely in Chinese and present the workflow, constraints, and warnings only in that language. This creates a natural-language locale constraint without any opt-in, alternative language handling, or documentation that the skill is intentionally region/language-specific.
The file’s natural-language comments and user-facing guidance are entirely in Chinese, including operational disclaimers and input instructions. The policy flags language/locale constraints when a skill effectively requires a specific language without user opt-in or an explicitly documented regional justification.
The disclaimer states that the tool checks the interest-rate relation (利息 = 期初 × 折现率), but the free-version code explicitly withholds that check. This can mislead users into believing a key validation was performed when it was not, causing false assurance in financial review results and potentially allowing erroneous schedules to pass unnoticed.
The script’s help text, status messages, and result formatting are hard-coded in Chinese with no language-selection mechanism, which can cause users to misunderstand inputs, warnings, findings, or exit conditions. In a contract-review/security-adjacent workflow, misunderstanding output can lead to missed issues or incorrect operational decisions, especially for non-Chinese-speaking operators.
The only natural-language content in this file is entirely in Chinese, including the headings and tabular labels, with no indication that the skill is region-specific or that users may select another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.