Security audit
Security checks for vulnerabilities and agentic risk
The advertised financial calculator performs no calculations and silently replaces missing or invalid inputs with zeros, making its reports unreliable.
Wait for corrected calculations, compatible template fields and explicit input validation before relying on this skill for business decisions. Independently check any figures. The optional unsigned Windows application is unnecessary for the Python workflow and is outside this review.
The declared primary capability is numerical calculation, but run() only parses and echoes inputs and appends a formula string. It never evaluates that formula or performs the arithmetic needed to produce the advertised metrics. Local file reading and report writing are supporting implementation details, not separate mismatches. No network access or other unrelated behavior is evident.
Without declared permissions the skill's intent is opaque and cannot be validated.
The script advertises calculated unit-economics metrics but only writes parsed inputs and an unevaluated formula to calculation.md, creating an output-integrity failure rather than a code-execution vulnerability. In a financial decision-support skill intended for board presentations, downstream users or agents could mistake this report for a completed calculation; silently converting missing or invalid inputs to zero compounds the risk. The report's guardrails reduce overclaiming but do not implement or validate the promised calculations.
No suspicious patterns detected.
