Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple local expense-workflow template generator with no hidden network, financial, or persistence behavior found.
Reasonable to install for informational workflow design. Treat its recommendations as templates rather than financial or accounting advice, and note that it runs a local Python handler to produce JSON even though the docs phrase this as no real code execution.
The module documentation says 'No real code execution or financial transactions,' which contradicts the actual behavior in the file: it defines executable functions, processes user input, and returns generated output. While the code does not execute external commands or financial transactions, the phrase 'No real code execution' is inaccurate for a handler that clearly runs logic.
The inline comment on L110 includes Chinese text ('其他skill类似') even though the file otherwise uses English and provides no indication that multilingual output or documentation is intentional. This creates an undocumented language choice in the skill file, which can conflict with organizational language/locale expectations.
The manifest sets the skill language to "en", which is a natural-language locale constraint. Under the policy, forcing a specific language without user opt-in or a clear region-specific justification is a violation.
No suspicious patterns detected.
