Security audit
Security checks for vulnerabilities and agentic risk
This skill performs disclosed Excel cleanup and deduplication locally, with no evidence of hidden access, persistence, network use, or credential handling.
Install only if you want a Chinese-language Excel cleanup helper. Use it on copies or let it write the default _cleaned.xlsx output, verify the deduplication key columns before running, and note that CSV support is advertised but not implemented in the inspected script.
整体上，代码的主要目的与描述高度一致：它确实执行表格清洗、手机号/身份证号标准化、按关键列去重，并生成报告 sheet。但存在一个重要描述不准确之处：声明明确写到可处理“xlsx/csv”，而实际代码仅依赖 openpyxl 打开 Excel 工作簿，没有任何 CSV 读取、解析或写出逻辑。因此描述覆盖的文件类型能力大于实际实现，属于能力描述不准确。除此之外，未发现明显越权、外部网络访问或无关功能。
The description says the skill triggers when a user asks to "去重", "清洗数据", or "数据标准化", which are broad phrases that can occur in many unrelated data-processing contexts. The activation scope is not narrowly constrained with exclusions or negative examples, increasing the risk of unintended invocation.
The trigger list includes generic terms like "去重", "清洗", and "名单整理", which overlap with everyday spreadsheet or list-management language. The file does not define boundaries for when these words should or should not activate the skill, so invocation conditions remain underspecified.
Natural-language text in the docstring and CLI output is exclusively Chinese, and the script provides no option to select another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific.
This code loads an Excel workbook, normalizes values, removes duplicate rows, and writes the transformed dataset to a new workbook. Although it prints a completion summary afterward, there is no pre-action warning or confirmation about potentially destructive data changes such as dropped rows and modified identifiers.
No suspicious patterns detected.
