Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Chinese-language ROI report generator with no evidence of hidden access, persistence, or data exfiltration.
Reasonable to install for Chinese-language presales ROI estimates. Treat results as rough business estimates, validate inputs before sharing reports externally, and avoid passing attacker-controlled free-form text into reports that will be rendered or published without review.
src/generator.js:367Unescaped CLI Input Allows Markdown and Terminal Output Injection
This JavaScript file generates all user-facing report content and command-line help exclusively in Chinese, including headings, labels, warnings, and parameter descriptions. Because the skill does not provide any mechanism for language selection or indicate that it is intentionally limited to a Chinese-only regional context, it violates the language/locale policy for natural-language content.
This code embeds user-facing expectations and report assertions entirely in Chinese, such as report headers and scenario names, implying the skill output is fixed to a specific language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified.
The usage string instructs users to supply example values in Chinese (e.g. "零售", "客服") with no indication that other languages are supported. This can constitute a language/locale policy issue because it implicitly constrains user interaction to a specific language without documented opt-in or justification.
The manifest description is written only in Chinese ("行业化 ROI 测算卡"), which indicates a fixed language choice without any visible user opt-in or documented locale constraint. This can violate language/locale policy expectations when the skill is otherwise not marked as region-specific.