Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a finance-analysis Markdown skill, but its documentation also advertises file writing, external API use, and command execution that do not fit its read-only manifest.
Review before installing. The core finance formulas are ordinary, but the skill should be treated as needing cleanup because it describes broader powers than it declares. Prefer a version that removes command execution, file writing, external API, and API-key guidance unless those capabilities are explicitly scoped, permissioned, and user-approved.
The manifest declares only read permissions/tools, yet the document elsewhere claims capabilities such as writing files. Permission-documentation mismatches are dangerous because they undermine reviewer trust, complicate policy enforcement, and create ambiguity that can be abused when the skill is ported or reimplemented on less restrictive platforms.
The skill declares itself as pure Markdown with no command execution required, but later instructs operators to run network/system commands such as ping. This mismatch is dangerous because it can mislead users, reviewers, and automated policy systems into granting trust to a skill that implicitly expands into command-execution behavior.
The skill is presented as a basic financial statement analysis tool, but the later claims of file writing, external API integration, and command execution materially broaden its operational scope. This is dangerous because users may invoke the skill for innocuous analysis while unintentionally enabling behaviors that touch the filesystem, network, or shell beyond the stated purpose.
The skill claims external API/network behavior even though the manifest exposes only read access. This mismatch is especially risky in a finance context because users may provide sensitive financial data under the assumption of local-only analysis, while the documentation suggests possible outbound transmission.
Advertising system command execution for a finance-analysis skill creates unjustified shell-access expectations without a clear business need. Even if not currently enabled in the manifest, such guidance normalizes command use and can lead operators or future platform mappings to execute diagnostic or arbitrary commands in contexts where only document analysis should occur.
The documentation claims command-execution capability despite a read-only manifest. Such contradictory signaling can cause unsafe deployment assumptions, especially if another agent runtime maps the prose instructions to broader tools than originally intended, turning a simple analysis skill into an execution-capable one.
The activation description is overly broad, covering generic data analysis, report generation, statistics, and visualization tasks beyond narrow accounting use. This can cause over-invocation in unrelated contexts, increasing exposure of user data and the chance that the skill's contradictory capability claims are surfaced in workflows where they do not belong.
The description explicitly says '支持中文交互', and the document consistently presents the skill as Chinese-interaction-oriented without any opt-in or alternative locale choice. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific.
The documentation advertises file writing despite the manifest allowing only read access. This inconsistency is dangerous because it can mislead users into expecting broader filesystem operations and may encourage future implementations or wrappers to add write behavior without proper review or permission hardening.
Claiming external API integration expands the trust boundary from local financial analysis to network-connected behavior. In this context, that creates unnecessary risk of data exfiltration, dependency confusion about what data leaves the environment, and user misunderstanding about whether the skill is offline or remote-service based.
