Security audit
Security checks for vulnerabilities and agentic risk
This is a local VAT worksheet checker that clearly lists its free-version limits and shows no network, credential, persistence, or destructive behavior.
Install only if you need a Chinese VAT summary-table arithmetic checker. It runs locally, but it processes financial tax data you provide; use it on intended worksheet inputs only, review the listed excluded checks, and do not rely on it as complete tax advice or filing assurance.
The skill’s description claims broad per-line VAT verification and mentions tax burden anomalies, but later documentation admits several important checks are excluded. In a finance/tax workflow, this can cause users to rely on incomplete validation and miss material filing errors, creating compliance and financial risk even without malicious code execution.
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
Referenced artifact was not completely inspected
node scripts/run.mjs --sample # 先看样例
The displayed name, primary descriptions, usage guidance, and operational content are all presented in Chinese, while the file does not state that the skill is limited to Chinese-speaking users or explicitly offer output-language choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The documentation presents the free version as performing broad VAT verification while elsewhere excluding multiple relevant checks. This inconsistency can mislead operators into believing a worksheet received fuller coverage than it actually did, reducing trust and potentially allowing accounting mistakes to pass undetected.
The trigger term '进销项' is very broad and may activate the skill during ordinary VAT-related discussion rather than an explicit request for worksheet verification. Unintended activation can inject irrelevant financial-analysis behavior into unrelated conversations and increase the chance of user confusion or accidental processing of sensitive accounting data.
Saying the editions differ only by excluded items conflicts with earlier messaging that frames tax burden verification as included in the free skill. Users may incorrectly assume anomaly detection or more complete tax burden analysis is present, which can affect tax review decisions.
The file-level natural-language documentation is entirely in Chinese and includes user-facing contract/advice text, but it does not indicate that the skill is China-specific only or that users may choose another language. This can violate language/locale policy when a skill effectively mandates one language without opt-in or documented regional constraint.
L075 的注释写明“不是 JSON 就当作纯文本材料（例如直接粘贴的合同全文）”，但该技能的 manifest 和其余文案都声明用途是增值税进销项汇总表逐项核对。这里的内联文档主动举出与技能目的无关的材料类型，和已声明意图相矛盾。