Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed local Excel workflow for editing copied workbooks while preserving formatting, with no hidden code, persistence, or exfiltration found.
Install only if you need a Chinese-language Windows/Office workflow for local Excel COM edits. Before using it on financial statements, work on a copy, confirm the exact workbook, sheet, cells, and accounting assumptions, and avoid relying on the promotional external links for operation.
The skill is written entirely in Chinese and presents its name, triggers, and operating instructions only in that language, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
The trigger phrases are broad enough to match ordinary spreadsheet-editing requests, which can cause the agent to invoke this Windows/Excel-COM-specific workflow in contexts where it is unnecessary or inappropriate. In practice, that can lead to unsafe file handling, incorrect tool selection, or unintended modification of user spreadsheets when a simpler or safer method should have been used.
The activation conditions describe broad business scenarios but do not specify sufficient guardrails, such as validating workbook type, confirming the target sheet, requiring backup/copy-only operation, or requiring explicit user authorization for financial statement edits. Because this skill edits financial reports and discusses manual adjustments, ambiguous activation increases the chance of accidental misuse, data integrity errors, or unauthorized changes to sensitive business records.
The manifest describes a local Windows/Office skill for preserving Excel formatting while editing financial report values. The author section adds WeChat contact info and multiple external web/image URLs, which are not justified by the operational purpose of editing spreadsheets and introduce unrelated external-facing capability/context.
No suspicious patterns detected.
