Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local, descriptive financial-statement helper with some broad wording and language inconsistency, but no hidden access, persistence, network use, or transaction authority.
Install only if you want a descriptive helper for understanding financial statements. Do not treat its outputs as professional accounting, tax, lending, or investment advice, and be aware that its broad triggers may make it appear for general finance questions unless narrowed by the user or publisher.
The trigger conditions are broad enough to match generic financial planning or guidance requests that are not specifically about interpreting financial statements. This can cause unintended activation, leading the agent to apply the wrong skill, produce misleading finance-related advice out of scope, or crowd out safer or more appropriate skills during routing.
The acceptance criteria state 'Clear documentation in English,' which imposes a specific language requirement in natural-language policy without any opt-in, alternative locale support, or stated regional/compliance justification. This matches the language/locale policy violation category for all file types.
The README title and core description are primarily in Chinese, while some examples are in English, but the skill does not state whether users may choose their preferred language. Under the policy rule, forcing or implicitly assuming a language/locale without opt-in can be a natural-language policy issue unless the regional constraint is explicitly justified.
The file includes a full usage scenario and expected output in Chinese, but does not explain that this is optional, user-selected, or limited to a Chinese-language context. That can conflict with language/locale policy expectations because the skill presents a specific language output mode without documenting user opt-in.
The manifest sets "language": "en", which imposes a specific language choice in the skill metadata. The file does not indicate that users can opt into other languages or that the English-only restriction is required for a documented region-specific or compliance reason.
No suspicious patterns detected.
