Security audit
Security checks for vulnerabilities and agentic risk
The executable code is a simple local invoice-field checker, but the skill metadata grants broad tools and gives inconsistent permission disclosures that deserve review before installation.
Review the requested tool access before installing. The validator code itself appears local and limited, but the skill should ideally remove unused Write/WebFetch authority or clearly explain why those tools are needed, and align its permissions and usage text with the actual script behavior.
The permissions block says network, filesystem, and subprocess are all false, but nearby text says the skill can call APIs, read/write files, and execute locally. This is a security-relevant inconsistency because enforcement systems or human approvers may rely on the declared permissions to sandbox or approve the skill, while the documentation indicates materially broader behavior.
This file presents all operational guidance in Chinese, including the title, purpose, and agent behavior rules, but does not indicate that Chinese is optional or that the skill is intentionally region- or language-specific. That creates a natural-language policy concern because it effectively forces a specific language for use and maintenance without user opt-in.
The manifest presents the skill as 'zero-dependency' and suitable for controlled invoice scanning, yet it simultaneously declares powerful tools such as Bash, Write, and WebFetch and describes API/local execution in the risk rationale. This kind of capability mismatch can mislead operators, policy engines, or reviewers into granting trust or approvals under false assumptions, increasing the chance that a higher-privilege skill is deployed without proper scrutiny.
The primary manifest description is written only in Chinese, despite the file otherwise being bilingual. This creates a language/locale policy concern because the main user-facing activation/description text does not offer a language choice or indicate opt-in for Chinese-only use.
Line L03 contains a natural-language instruction entirely in Chinese and directs AI-agent behavior. This can be interpreted as a language/locale preference being imposed without any indication that users or agents may choose another language.
The user-facing description and argument help strings are written only in Chinese, which imposes a specific language/locale on all users. This matches the policy category for language or locale constraints because the file does not provide any opt-in or alternative language selection.
No suspicious patterns detected.
