Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, user-run financial report extraction helper that reads a chosen text file and writes a chosen Excel file without network access, persistence, or credential handling.
Install only if you are comfortable processing audit-report text locally with this skill. Review the Excel output path before running because an existing file at that path may be overwritten, and verify all extracted financial figures manually before using them in bids or filings.
This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The workflow and usage instructions state that the skill will process audit-report text and output an Excel file, but they do not disclose privacy/data-sensitivity considerations or caution users to verify output paths before writing files.
This markdown test-case file presents the skill content exclusively in Chinese, including the title and all test case descriptions. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not shown here.
This markdown file uses Chinese for all substantive user-facing content, which can amount to a language/locale policy violation if users are not given an opt-in or alternative language. The file does not indicate that the skill is region-specific or provide any multilingual option.
A natural-language policy issue may exist because the skill-facing report uses only Chinese text and does not provide any user opt-in or language/locale selection. Under the stated policy, forcing a specific language without user choice can be a violation unless the locale constraint is clearly documented and justified.
This markdown file states that the skill can output an Excel results file and perform automated data extraction and calculation, but it does not include any warning about creating files or handling potentially sensitive financial data. For markdown files, user-facing descriptions should disclose behaviors that may affect user data or system state.
Line L17 states that the script runs normally and can perform automatic data extraction and calculation, but the provided file is a Markdown test report with no code. This is an active contradiction between the document's claim about implemented behavior and the actual contents of the file under review.
