Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed internal workflow for creating and sending VIP reconciliation configuration spreadsheets, with no hidden code, persistence, or unrelated behavior found.
Before installing, users should be aware that this skill processes merchant, store, and terminal identifiers and can send the generated spreadsheet to a named internal contact and create a Feishu task. Confirm the file contents, recipient, and task details before approving delivery.
The trigger phrases are very broad business terms like '配置对账单' and 'VIP配置', which can plausibly appear in ordinary discussion and cause unintended activation. Because this skill initiates a workflow involving financial configuration data and downstream messaging/task creation, accidental invocation could lead to premature collection or handling of sensitive merchant information.
The skill instructs the agent to send a generated file containing merchant and terminal identifiers to another person and create a task, but it does not require explicit user authorization for external sharing at the point of transfer. Even though it includes an initial user confirmation of the file contents, that is not the same as a clear consent checkpoint for sharing potentially sensitive business data with named third parties.
The instruction “纯英文，不要中文” imposes a language constraint on output format. The file does not explain why this restriction is necessary or provide an opt-in or alternative, which can conflict with language/locale policy expectations.
