Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local manufacturing worksheet checker that reads user-provided files, runs deterministic checks, and does not show evidence of hidden network, persistence, or destructive behavior.
Install only if you are comfortable using a Chinese-language, local Node.js checker for manufacturing worksheets. Provide it only the worksheet directories you want analyzed; it does not replace audit, legal, or business approval review, and withheld items are not executed in this free version.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
If only warehouse turnover and slow-moving inventory checks are implemented, the current claims still overstate the package and can mislead users into assuming full manufacturing controls testing. The lack of original file citation capability further undermines traceability promised by the documentation.
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单对象样例（内置）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单对象样例（内置）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单对象样例（内置）
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 单对象样例（内置）
The skill’s title, summary, descriptions, usage guidance, and operational instructions are predominantly in Chinese, while the English content is limited to a short metadata description. This creates a language/locale constraint for users without explicitly offering a language choice or documenting that the skill is intended only for a Chinese-language audience.
This JavaScript file contains extensive natural-language instructions, comments, sample object names, advice, notes, and disclaimers entirely in Chinese. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the skill offers a language choice or clearly documents a justified regional constraint, which this file does not.
The comment at L333 states that the following functions are only called in the full version and that their conclusions are not output in the free package. However, the main run result still constructs and returns full-version-related containers like overuse_by_group, action_plan, and checks_not_run, which contradicts the stated intent that these paid-path elements are not part of free output.
The file header says this free package only implements the free subset and that paid-tier capabilities are not implemented here, but the returned result still includes paid-tier shaped outputs such as overuse_by_group, action_plan, and checks_withheld/checks_not_run. Even though these are empty or descriptive, the runtime behavior goes beyond a narrowly free-check-only result contract and surfaces artifacts of the withheld feature set.
The file’s natural-language interface, guidance, error messages, and result text are written entirely in Chinese, including the documented contract and user-facing responses. Because there is no opt-in, fallback, or documented region-specific justification, this is a locale policy concern under the language-choice rule.
This JavaScript skill embeds its descriptive contract, input guidance, labels, and user-facing output text entirely in Chinese, with no indication that other languages are supported or that the user can opt into Chinese. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly documented as a justified region-specific tool.