jiesuan

Key points to confirm before installing or using this skill: - Clarify AI usage: SKILL.md lists an API endpoint (http://wanqing.internal) and a model name. Ask the author whether the agent will actually send rule text to that endpoint. If so, ask what authentication is required, whether traffic is encrypted, and whether the endpoint is internal/trusted. Do not assume data is local until this is confirmed. - Credentials and network behavior: The package declares no environment variables for API keys. If remote calls are used, the skill should explicitly require and document safe credential handling (no hardcoded secrets) and disclose network destinations. - Excel support mismatch: The documentation says .xlsx/.xls are supported but the code only reads CSV. If you need Excel support, request that the author add a proper Excel reader (e.g., openpyxl or pandas) or clarify that CSV is the required input format. - Rule parsing limitations and bug: The included RuleParser only implements a very small subset (guaranteed mode) and contains a regex bug (typo using 'd+' instead of '\\d+'), which can cause parsing failures or incorrect payouts. Request fixes and more comprehensive parsing tests before trusting results for real payouts. - Test locally with non-sensitive data: Run the Python engine locally on representative CSVs to verify behavior, edge cases, and that no network calls occur. Inspect logs and use network monitoring if you suspect remote calls. - Security practice: If rule text must be sent to an external model, avoid including any PII or sensitive business data in the rule text. Prefer a local parsing solution or a documented, authenticated, and TLS-protected model endpoint within your trust boundary. - Request documentation and unit tests: Ask for explicit runtime instructions (how/when the AI is invoked), required env vars (if any), and unit tests demonstrating correct payouts for representative rule scenarios. Given these inconsistencies, treat the skill as suspicious until the author clarifies the AI invocation behavior and addresses the parsing/format-support issues.