Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local financial goal planning helper with no evidence of hidden access, persistence, network use, or financial transactions.
Installers should treat this as informational personal-finance guidance, not professional financial advice. The mixed English/Chinese documentation may affect user expectations, but the inspected artifacts do not request sensitive access or perform actions outside local response generation.
The top-level skill description is written as a directive in Chinese and does not state that users may choose their preferred language or locale. Because the README also includes English user examples later, this creates a natural-language policy concern that the skill may default to a specific language without explicit opt-in.
The manifest sets language: en at L06, but the skill later includes a full Chinese-language scenario at L34-L36. This creates an inconsistent language policy and may imply a fixed locale without explicitly offering user opt-in or clarifying multilingual support.
The module docstring states "No real code execution," which contradicts the actual implementation: the script defines parsing and response-generation logic and runs via a main entrypoint. This is an intent/documentation mismatch, even though the executed code is benign and does not perform transactions.
This Python file includes the natural-language comment "其他skill类似" on L110, which mixes in Chinese without any indication that the skill is intentionally bilingual or region-specific. Under the language/locale policy, forcing or embedding a specific language without opt-in can be a policy concern even when it appears in comments or string-like instructional text.
The manifest sets the skill language to "en", which is a natural-language locale restriction. Under the policy, forcing a specific language is a violation unless the skill offers a language choice or clearly documents a justified regional constraint, neither of which is present here.
No suspicious patterns detected.
