Security audit
Security checks for vulnerabilities and agentic risk
The bundled skill has limited local access, but its incomplete calculator should not be relied on for business decisions.
Do not treat successful report generation as completed analysis: independently calculate and verify the results until the script and template are corrected. Use a dedicated output folder because calculation.md is overwritten. The optional unsigned Windows app is unnecessary for this workflow and requires separate evaluation.
The script assigns the financial formulas to a string and prints that string in calculation.md; it never evaluates them. Its primary behavior is input transcription and report generation rather than the declared break-even calculation. Local input reading and output writing are supporting implementation details, and no unrelated resource access or undeclared external activity is evident.
Without declared permissions the skill's intent is opaque and cannot be validated.
The script parses inputs and writes a calculation report containing a formula string, but never computes contribution margin, break-even units, break-even revenue, or headroom. This is a functional-integrity failure rather than a code-execution vulnerability: users or downstream agents may mistake successful report generation for completed financial analysis. The financial decision-making context increases the consequences of relying on the incomplete output, although there is no evidence of malicious intent.
No suspicious patterns detected.
