内控-集团客户部FY审计
WarnAudited by ClawScan on May 12, 2026.
Overview
The skill fits a rebate-audit workflow, but some helper scripts can delete or rebuild audit database data and run code from an external path, so it needs review before use.
Before using this skill on real audit data, make a database backup, verify that scripts run only from the packaged skill directory, require explicit approval for any reparse/delete operation, and confirm where Feishu cloud uploads and old-file deletions will occur.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running a normal-looking monthly parse for an existing month could erase and replace audit records, potentially changing historical audit results.
The core monthly parser removes existing records for the target month before parsing. This conflicts with the append-only/no-history-modification workflow described in the skill and has no visible confirmation or backup gate in the shown code.
conn.execute("DELETE FROM raw_records WHERE month=?", (month,))
conn.execute("DELETE FROM brand_audit WHERE month=?", (month,))Require an explicit user confirmation or a separate --reparse flag before deleting existing records, and create a backup before any DELETE operation.
A single batch command could remove the entire stored audit dataset and leave the database incomplete or inconsistent.
A batch helper can wipe all raw and brand audit rows before reparsing every month. If it is run unintentionally or fails mid-run, the impact propagates across the whole audit database.
# Delete ALL existing data
c.execute('DELETE FROM raw_records')
c.execute('DELETE FROM brand_audit')Do not run full reparse scripts without a verified backup, transaction/rollback plan, dry-run output, and explicit user approval.
The agent may execute a different parser than the one included with the skill, which can cause incorrect results or unsafe database changes.
The provided package contains scripts/parse_one_month.py, but this helper executes an absolute /workspace/scripts path outside the skill tree. That can run unreviewed or unexpected code if such a file exists in the environment.
SCRIPT = '/workspace/scripts/parse_one_month.py'
...
subprocess.run(
['python3', SCRIPT, month],Use a path relative to the skill directory for packaged scripts, or explicitly declare and review any external helper paths before execution.
The agent may create, upload, or delete audit report files in the user's cloud document space.
The workflow expects using the user's Feishu cloud storage and deleting old generated files. This is disclosed and scoped to report delivery, but it uses account/file authority.
所有文件只保存到用户**个人云文档（飞书云盘）**，不写入知识库 - 仅保存最新版，旧版先删除再上传新文件
Confirm the Feishu account, folder, and deletion scope before allowing upload or cleanup actions.
Audit outputs, console logs, or database backups may contain merchant and bank-account details.
The parser stores rebate recipient email, account-name, bank, and bank-account fields in the local SQLite audit database. This is relevant to the audit purpose but is sensitive financial/payment information.
DB = "/workspace/业务数据/集团客户部FY数据.db" ... "对公返佣_返佣邮箱", "对公返佣_户名", "对公返佣_开户行", "对公返佣_银行账号", ... "对私返佣_银行账号"
Run only in a trusted workspace, restrict report and database sharing, and avoid uploading the database unless the destination is approved for sensitive financial data.