Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local financial-ledger checker that reads user-supplied input and runs bundled Node.js code without network use or persistence.
Install only if you are comfortable using a Chinese-language local Node.js ledger checker. It does not appear to send data out or persist changes, but its conclusions are arithmetic/data-quality checks only and should not be treated as legal, audit, tax, or securities-compliance advice.
整体上代码的主用途与描述高度相关，都是对关联方往来台账做本地化、无网络的免费版核对；不存在越权访问或无关能力。但描述有两点不准确：其一，‘每条结论引用原文’属于输出行为承诺，代码并未保留或摘录原文片段，只是生成字段化证据与数值重算结果；其二，描述列举的检查范围偏窄，而代码实际多做了负数余额、符号反转、计息情况缺失等检查，属于未充分声明的能力。基于题目要求，存在描述与行为的不一致，应判定为 mismatch。
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
The file’s user-facing comments and guidance are entirely in Chinese, including the required input format and operational disclaimers. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.
The only natural-language content in this file is a Chinese table template, which indicates the skill output/content is fixed to Chinese. There is no accompanying opt-in, alternative locale, or justification that this skill is specifically region- or language-bound, which can violate language/locale policy requirements.
The docstring says non-JSON input is treated as plain-text material such as '直接粘贴的合同全文', which contradicts the rest of the script and manifest that expect a related-party ledger with headers. The actual usage/help text consistently requires a ledger/table input, so this inline documentation is misleading about accepted material type and skill intent.