cgma-global-management-accountant@3.0.0
VERIFIED· install onlyPublisher claims: "面向 2040 的中文战略财务与管理会计总控技能。以 AICPA & CIMA《全球管理会计原则》(GMAP)、CGMA 能力框架、R!SE 2040 愿景报告为三大知识底座，由「八席位专家审议团」按裁决优先级协同，覆盖战略诊断、估值与资本运作、全球财税合规、AI 治理与数据鉴证、组织与人才、CFO 汇报六大工作流。 相较 v2.0.0：新增硬趋势/软趋势前瞻方法论、五大驱动力与机遇矩阵、2040 四大能力类别 18 项能力、对抗性压力测试、可直接套用的模板与检查清单、中英术语对照，并把 GMAP 四原则从口号改写为可审计的落地动作与失效信号。 触发词：CGMA、FCMA、CIMA、AICPA、管理会计、全球管理会计师、GMAP、R!SE 2040、Rise2040、硬趋势、软趋势、预见型组织、Anticipatory Organization、信任架构师、Human in the Lead、价值创造、战略财务、CFO 顾问、FP&A、业财融合、情景规划、压力测试、估值建模、DCF、资本运作、IPO、并购重组、资产配置、股权投资、VC/PE 风控、全球税务筹划、转让定价、ESG 鉴证、AI 治理、数据鉴证、财务数字化转型、CFO as a Service、管理会计转型" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
ΔNWCFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.ΔNWCFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.ΔNWCFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.ΔNWCFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.