Security audit
Security checks for vulnerabilities and agentic risk
This quote generator needs review because it ignores user tax settings and cannot correctly process its supplied template, creating unreliable customer estimates.
Treat outputs as unverified drafts until template parsing and user-controlled tax handling are corrected. Check every amount and required contract term before customer use. Use a dedicated output directory to avoid overwriting earlier estimates. The optional Windows app is unnecessary for this workflow and requires separate assessment.
Without declared permissions the skill's intent is opaque and cannot be validated.
The script unconditionally applies a 7% tax rate without obtaining a user-confirmed rate, contradicting its generated guardrail that tax rates must be user-supplied. US HVAC tax treatment varies by jurisdiction and transaction, so this can produce incorrect customer-facing totals and potential billing or tax-compliance problems. The rate is disclosed in the output, which reduces concealment risk, but the intended use for signable contractor quotes makes the integrity issue consequential.
No suspicious patterns detected.
