Security audit
Security checks for vulnerabilities and agentic risk
This is a local sales-commission checking skill that reads user-provided table data, runs deterministic calculations, and does not show network, persistence, credential, or destructive behavior.
Before installing, treat this as a Chinese-language local table checker for sales commission data. Review its results as arithmetic assistance, especially because findings cite row and field evidence rather than full original excerpts, and confirm any commission policy decisions against your own company rules.
整体上，代码的主用途与声明高度一致：都是针对销售提成/业绩表做免费版、本地、无网络的勾稽核对，且免费/付费分层说明也一致。大部分能力都匹配，包括逐行复算、合计、重复、空缺检测。之所以判定存在不匹配，主要有两点：第一，声明中的“每条结论引用原文”是对输出证据形式的明确承诺，但代码并没有保存或回显原始文本片段，只输出行号、字段名和复算结果，因此这一描述未被实现；第二，代码还做了“负数检测”，这属于额外检查能力，虽然相关且风险不大，但仍是未声明能力。综合看，这不是主目的偏离，而是描述与实际行为在输出方式和检查范围上存在实质性差异。
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
The file’s user-facing comments, instructions, labels, advice, and output strings are entirely in Chinese, including required input guidance and result messaging. There is no indication that the skill is region-specific or that users may choose another language, which creates a natural-language locale policy concern under the rule.
The user-facing title, usage, help text, errors, and operational messages are entirely in Chinese, and the file does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the policy rule, a fixed language/locale without opt-in is a natural-language policy concern.
The comment documents the fallback as handling '纯文本材料（例如直接粘贴的合同全文）', i.e. even a full contract text, while the rest of the file consistently describes the tool as operating on a sales commission/performance reconciliation table with headers. That documentation broadens the apparent intent beyond the actual declared skill purpose and conflicts with the surrounding usage/help text focused on table inputs.