Security audit
Security checks for vulnerabilities and agentic risk
This skill provides local, informational payment-term negotiation guidance without hidden access, external calls, transactions, or persistence.
This appears safe to install for informational negotiation guidance. Users should treat its financial suggestions as templates, not professional financial or legal advice, and may want clearer language expectations because the documentation mixes English and Chinese examples.
These lines introduce a scenario and expected output entirely in Chinese, while the document otherwise uses English and does not state that multilingual output is optional or user-selected. This can violate language/locale policy because it implicitly forces a specific language for part of the skill without opt-in or justification.
The module docstring states 'No real code execution,' which contradicts the actual behavior: this script defines executable logic, parses user input, and runs as a CLI entrypoint under main. While it does not execute arbitrary commands or perform transactions, the wording actively misdescribes what the code does.
The comment on L110 contains Chinese text ("其他skill类似"), which introduces a language-specific element in the file without any indication that multilingual content is intentional or user-selected. Under the policy, forcing or introducing a specific language without opt-in can be a locale/language policy issue.
The manifest explicitly sets the skill language to "en", which imposes a specific language choice. Under the policy rules, locale or language constraints should either be user-selectable or clearly justified; neither is present here.
No suspicious patterns detected.
