Security audit
Security checks for vulnerabilities and agentic risk
This is a local Excel template generator for Zhoupu order imports; it has documentation rough edges, but no hidden network, credential, persistence, or destructive behavior was found.
Install only if you use this specific Zhoupu Chinese-language order workflow. Review generated spreadsheets before importing, especially quantities, barcodes, units, prices, and the self-pickup output columns, because the documentation and generated column count do not fully match.
主要不一致点在于声明描述了同时涉及“自提订单+调拨订单分开”的订单导入模板生成能力，但该代码从标题、sheet名、输出文件名、字段规则到主流程都明确只处理“自提订单”。没有任何调拨订单生成、拆分到另一表、或双类型输出的逻辑。另一方面，描述虽然提到把下单表转成舟谱可导入Excel，这一点与代码基本一致；代码确实生成Excel模板，且只有1个sheet，也符合部分描述。但实际实现比声明更具体：它不仅转换格式，还依赖价格表、补充价格、按客户映射价格列、生成单价并进行数量/必填校验。因此应判定为描述与实际行为存在实质性不匹配，核心原因是缺失了声明中的“调拨订单”能力。
该代码的主功能与描述部分重合，但范围明显更窄。描述宣称是“订单导入模板生成（自提订单+调拨订单分开）”，暗示支持两类订单；而实际代码文件名、参数说明、sheet标题、字段设计和处理逻辑都只针对“调拨订单”。代码没有任何自提订单分支、输出结构或相关处理逻辑。因此属于描述覆盖范围大于实际行为的功能性不一致。除此之外，代码未表现出其他未声明的敏感能力；读取Excel、价格表匹配、生成导入文件、校验统计都属于该已声明目的的实现细节。
Without declared permissions the skill's intent is opaque and cannot be validated.
The entire skill description and operating instructions are written only in Chinese, including the manifest description and all user-facing workflow guidance. This can constitute a language/locale policy issue because the skill effectively requires a specific language without an explicit user opt-in or a documented regional justification.
文件头注释在L009明确写明“模板字段（9列）”并列出9个字段，但generate_excel在L309-L330实际定义并输出了19列完整模板。这里不是简单的文档省略，而是对输出格式的核心描述与实际行为直接不一致，可能误导调用方对生成文件结构的理解。
This file contains user-facing natural-language instructions entirely in Chinese, including the module description and usage/help text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
The script's print messages, warnings, and status outputs are presented only in Chinese throughout execution. This enforces a single language for operational interaction and error handling without any language selection mechanism or documented locale justification.
The top-level natural-language documentation is entirely in Chinese and presents usage and operating rules only in that language. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or justification is provided.
No suspicious patterns detected.
