Security audit
Security checks for vulnerabilities and agentic risk
This is a construction cost estimating skill with some reliability and scope-documentation issues, but no hidden execution, credential access, persistence, or exfiltration behavior was found.
Install only if you want help with construction cost estimates. Treat outputs as draft calculations, verify applicable standards, rates, currency, and category mappings before using them for bids, contracts, or regulatory submissions, and be deliberate about any spreadsheet export path.
The natural-language description, headings, API examples, and field names are entirely presented in Chinese, with no indication that users may choose another language or locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific and documented as such.
The skill advertises compliance with GB/T 50500-2024, but 设置标准费率 explicitly says it applies rates based on 建标[2013]44号. In a construction-cost estimation context, this mismatch can systematically produce non-compliant or misleading estimates, causing downstream financial, contractual, or regulatory harm.
The implementation and examples reference enum members such as CostCategory.专业工程费 that are not actually defined in the enum, which instead defines 专业工程. This creates runtime failures and inconsistent category handling during import, calculation, and example execution, undermining reliability of cost outputs in a financial estimation tool.
The '触发场景' section lists generic activities such as '建设工程估算编制' and '造价构成分析' without defining explicit trigger phrases, boundaries, or non-trigger examples. In a markdown skill description, this can create ambiguous activation conditions and increase the chance of unintended invocation for ordinary construction-cost discussions.
The instruction activates on when the user asks to "create or build an estimate," but it does not define clearer scope boundaries, exclusions, or concrete trigger examples. In a markdown skill description, this broad phrasing can cause unintended invocation for loosely related estimation or planning requests.
The phrase "analyze or review an estimate" is broad and does not state what kinds of estimates are in scope or when the skill should not activate. Without narrower context or exclusions, this may match common conversational requests beyond the intended construction-cost domain.
