Security audit
Security checks for vulnerabilities and agentic risk
This is a simple finance guidance skill with no executable code, network behavior, persistence, or hidden authority, though users should avoid sharing unnecessary sensitive financial details.
Installers should understand this skill is Chinese-language finance guidance. Use summarized or redacted financial information where possible, and do not paste account numbers, card details, passwords, government IDs, or exact transaction identifiers.
The natural-language content of the skill, including the description, triggers, usage instructions, and disclaimer, is presented only in Chinese. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified, which is not stated here.
The file presents all instructions, examples, and output format exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no alternative language choice or justification is provided.
This markdown skill forces a specific language/locale through all headings, instructions, and examples, but does not state that the skill is China/Chinese-specific or offer the user an opt-in choice. Under the policy, unqualified language forcing is a natural-language policy violation unless it is justified or optional.
All instructions, examples, and output format are presented solely in Chinese, which effectively forces a specific language experience. The file does not state that the skill is region-specific or give users an option to use another language, which matches the language/locale policy violation criteria.
The module explicitly asks users to paste detailed spending records, which can contain highly sensitive financial and behavioral data, but provides no warning about privacy, minimization, or redaction. In a budgeting skill, this increases the risk of unnecessary collection and exposure of personal financial information through logs, screenshots, or downstream processing.
No suspicious patterns detected.
