Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to process user-provided DXF and Excel engineering files for pile extraction and reporting without hidden network, credential, or persistence behavior.
Before installing, confirm the Chinese-language workflow fits your project and run it on copies of important DXF and Excel files, especially when using the interpolation step because it updates the provided workbook directly.
声明描述的是一个面向桩基工程统计的完整数据提取与计算工具，但代码片段实际只是一个DXF诊断/预分析脚本。它读取DXF后输出实体类型统计、图层分布、疑似相关图层、数值TEXT样本和块定义信息，属于辅助性结构分析功能。虽然这些输出可能为后续开发桩参数提取提供线索，但当前代码没有实现声明中的核心能力，且主要用途与声明明显不同，因此构成显著不匹配。
代码与描述的大部分核心能力是一致的：使用 ezdxf 读取 DXF，提取桩中心坐标、编号、桩径、桩顶标高，并生成 Excel 统计表和汇总表。这部分与“桩参数统计、DXF提取桩”高度匹配。 但描述中明确声称还支持“从等高线图层插值中风化/微风化岩面标高并计算入岩深度”，而代码中没有任何关于等高线、地层面、岩面、插值算法（如TIN/IDW/线性插值）、相关图层扫描或入岩深度计算的实现。代码只处理 CIRCLE/LWPOLYLINE/TEXT/MTEXT 等实体来识别桩及标签，不涉及岩面分析。因此描述夸大了实现能力，构成描述与实际行为不一致。未发现额外的未声明敏感能力；不匹配点主要是声明了未实现的地质/入岩分析功能。
声明描述的核心功能是“从DXF提取数据并生成Excel分析结果”，且包含地层/岩面插值与入岩深度计算。实际代码的核心功能完全不同：它依赖外部Excel作为输入数据源，而不是从DXF识别或提取桩信息；随后在DXF中新增图层和文字标注，把桩编号写回图纸。代码既没有解析桩顶标高、也没有生成统计Excel、没有任何等高线图层插值或入岩深度分析逻辑。因此这不是轻微实现差异，而是主要用途与能力均明显不符。
The module docstring, CLI usage examples, worksheet labels, and console messages are written in Chinese, and the generated Excel headers also hard-code Chinese text. Because the skill does not provide any user opt-in or configurable locale selection, it imposes a specific language on all users, which matches the language/locale policy-violation category.
The script saves changes directly back to the user-supplied Excel path, which can overwrite the original workbook without confirmation or creation of a backup. In this skill context, the main risk is accidental data loss or corruption of engineering deliverables rather than code execution, but that can still materially impact bids, quantity takeoffs, and project records.
This code file contains user-facing natural-language strings entirely in Chinese, including the module description and CLI usage text. Under the language/locale policy rule, forcing a specific language without opt-in or justification is a policy concern when no alternative language choice or locale limitation is documented.
This code file includes user-facing documentation only in Chinese, and later user-facing runtime messages are also presented in Chinese. Under the policy, forcing a specific language without offering user choice can be a natural-language policy violation.
The script prints operational status, warnings, and usage instructions entirely in Chinese. Because no language or locale selection is offered, the skill effectively forces a specific language for interaction.
No suspicious patterns detected.
