Security audit
Security checks for vulnerabilities and agentic risk
This is a local IBAN validation helper with some documentation mismatches, but no hidden access, persistence, credential use, network behavior, or destructive actions.
Install only if a local, offline IBAN format/checksum check is sufficient. Do not treat a valid result as proof that the bank account exists or is safe to pay, and expect some documentation examples to need correction before developer use.
The skill metadata and documentation claim support for validating IBANs for 100+ countries, but the implementation is reported to support only a much smaller subset. In a financial-validation context, this can cause unsupported-country IBANs to be incorrectly rejected or mishandled, leading downstream systems or users to make trust decisions based on inaccurate validation coverage claims.
The file presents the skill description and usage guidance entirely in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The manifest describes the skill as checking IBAN format and mod-97 checksum for 100+ countries. However, the module docstring explicitly says '~40 pays principaux supportés' and 'not the complete ISO 13616 list', which narrows the represented coverage and creates a semantic mismatch about actual supported scope.
The skill documentation is written in French throughout key user-facing sections such as problem statement, usage labels, tests, limitations, and spec. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this README does not indicate that the skill is intentionally limited to French-speaking users or a French-only deployment context.
The inline documentation states that only about 40 major countries are supported, but the IBAN_LENGTHS table that follows contains a much larger set of country codes, roughly consistent with broad multi-country support. This is an active contradiction between documentation and implemented behavior, not merely an omission.
The top-level natural-language documentation is written entirely in French, including the limitations and title text, with no indication that the skill is intentionally region-specific or that users can opt into another language. This creates a locale/language policy concern because the skill presents a fixed language experience rather than offering a choice or documenting the constraint.
No suspicious patterns detected.
