Security audit
Security checks for vulnerabilities and agentic risk
The bundled skill performs limited local file operations, but its incomplete calculator requires manual verification before any customer use.
Treat this as a drafting aid rather than a working calculator. Independently calculate costs, correct the input-field mismatch, and validate missing or malformed values before sharing a quote. Choose an output folder where overwriting calculation.md is acceptable. The optional Windows application requires a separate security assessment; this verdict covers the bundled files.
Without declared permissions the skill's intent is opaque and cannot be validated.
The script advertises a net-cost calculation but only echoes input values and the formula text, never computing or reporting net_cost. In a financial quoting workflow, this output-integrity defect could cause an installer or downstream agent to treat an incomplete report as a completed estimate and communicate misleading costs; the savings and incentive disclaimers do not correct this omission. There is no evidence of malicious intent or a code-execution vulnerability.
No suspicious patterns detected.
