Security audit
Security checks for vulnerabilities and agentic risk
The calculator code is simple, but the skill metadata and workflow claim broader write, network/API, and audit-log behavior than the tool consistently declares or implements.
Review before installing. The core script appears to be a local financial-compliance calculator, but install it only if you are comfortable with the broad allowed-tools metadata or after the publisher narrows/removes WebFetch and Write, clarifies whether audit logs or reports are actually written, and documents where any compliance records would be stored.
The skill declares network: false, filesystem: false, and subprocess: false, yet the risk rationale says it performs API calls, file reads/writes, and local execution. This inconsistency can cause reviewers or runtime policy systems to misclassify the skill's true capabilities, potentially allowing deployment under weaker scrutiny or causing unsafe assumptions about what the skill can do.
This is a natural-language locale policy concern because the skill content appears to force a specific language for use and maintenance. The file does not indicate that Chinese is optional, nor does it offer an alternative language path for users or maintainers.
The description and display naming present Chinese as the default user-facing language for the skill, while the policy requires language choice or a documented justification for locale constraints. Although English text exists elsewhere, the file does not state that the user can choose language or that Chinese is required for a region-specific deployment.
The documentation says the system will generate a standardized compliance report and write an audit log, which implies persistence or file output. However, the manifested interface and output schema describe only stdout JSON from a CLI tool, with no corresponding implemented logging/reporting behavior shown in this skill file.
The script description, help text, and normal output are hard-coded in Chinese with no language-selection option. This can prevent or delay correct understanding by non-Chinese-speaking operators, which is especially risky in a compliance tool because users may misunderstand suitability decisions or reporting-threshold results and act incorrectly.
This markdown includes a full Chinese-only section and licensing block after the English section, but it does not state that language presentation is optional or user-selectable. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.
The visible natural-language content in this file is entirely in Chinese, including the core description and usage guidance. There is no indication that the skill supports multiple languages, offers user opt-in, or is explicitly limited to a Chinese-language/regional compliance context, which can violate language/locale policy requirements.
