Security audit
Security checks for vulnerabilities and agentic risk
This is a local loan-rate disclosure checker with no observed exfiltration or persistence, but its documentation overstates supported inputs and benchmark-rate freshness.
Use this only as a first-pass local screening aid. Supply the current benchmark rate yourself with --base, do not rely on the docs for JSON/CSV ingestion or automatic rate conversion, and keep legal/compliance review in the loop for real lending decisions.
This file presents all operational guidance in Chinese and does not indicate that users or agents may select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
The top-level description is written in Chinese and presents the skill in that locale by default, while the file does not state that users may choose their preferred language. This can violate a language/locale policy when a skill imposes a specific language absent explicit opt-in or a documented region-specific justification.
The usage section describes unsupported inputs and outputs such as input_data, compliance_status, and JSON/CSV file ingestion that are not present in the declared CLI schema. In an orchestration environment, this interface confusion can cause callers to pass wrong data, skip validation paths, or mis-handle results, producing silent compliance failures rather than obvious errors.
The documentation says the skill will fetch the current benchmark rate, but the manifest declares networking disabled and only exposes a local optional base parameter. This mismatch can cause operators or downstream agents to rely on a freshness guarantee that does not exist, leading to incorrect compliance decisions in a finance-related workflow.
The Chinese usage documentation repeats contradictory operational details, including unsupported parameters and ingestion modes, creating the same interface ambiguity for Chinese-speaking users. Because this skill is positioned for compliance review, inconsistent multilingual docs increase the chance of incorrect use and inconsistent enforcement outcomes across teams.
The argparse description, help text, validation errors, and output strings are all hard-coded in Chinese. This imposes a specific language on users without any opt-in, fallback, or documented region-specific justification, which matches the language/locale policy-violation category.
The primary display name is Chinese, with English relegated to a secondary field, but the skill does not explain whether language selection is user-driven. Without opt-in or a justified locale limitation, this can be a natural-language policy concern.
The natural-language content of the file is entirely in Chinese, including the skill description and key file annotations, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy, a language constraint should be optional or explicitly justified to avoid imposing a locale without opt-in.
