Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese payroll/social-insurance table checker with minor documentation inaccuracies but no evidence of hidden data access, network use, persistence, or destructive behavior.
Install only if you need a Chinese-language local checker for社保/公积金缴费基数核对表. Keep in mind that payroll and employee contribution tables are sensitive, but this package appears to process the provided file locally without network calls or persistence; verify important HR or compliance decisions against official local rules because the tool only checks internal arithmetic and table consistency.
整体上，代码的大方向与声明较接近，确实是在做社保/公积金缴费基数相关表格核对，且只执行免费档检查项、无额外资源访问、无网络请求，这些都与声明一致。但仍存在实质性描述偏差。最明显的是声明要求“每条结论引用原文”，而实现仅根据解析后的单元格和值生成说明消息，没有保留或输出原文引用片段。其次，声明表述侧重“基数核对表逐项核对（逐行复算、合计勾稽、重复与空缺检测）”，而代码实际主检查还包括单位/个人缴费额与比例乘算关系，以及基数/比例为负或为零检测，这超出了仅“基数核对”的直观范围。故应判定为存在描述与行为不完全一致的情况。
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
The file’s natural-language instructions, labels, sample input, and user-facing messages are entirely in Chinese, which imposes a specific language/locale on users. The policy allows locale constraints only when users are offered a choice or the restriction is clearly documented and justified as region-specific; this file does not provide such opt-in or explicit language limitation.
The JSON payload contains only Chinese headers and values, indicating a fixed-language output format. For a general-purpose skill artifact, this imposes a specific language/locale without offering user opt-in or documenting that the skill is intentionally region-specific.
The inline documentation states that non-JSON input is handled as plain-text material such as a '合同全文' (full contract text). That contradicts the surrounding manifest and code intent, which consistently describe this skill as operating on social-insurance contribution-base check tables with headers, not general contract documents.