Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed productivity check-in skill that uses scheduled reminders and memory for habit tracking, with some manageable risk from broad trigger phrases.
Install only if you want a recurring daily habit reminder and persistent progress tracking in Hermes memory. Consider using the more specific trigger "lazy system" or "懒人系统" and review or remove the cron job and memory entry if you later stop using it.
The trigger phrase "check in" is very broad and appears in ordinary conversation, which can cause accidental invocation of the skill when a user is not intending to activate it. Because this skill initiates memory-backed behavior tracking and scheduled check-ins, unintended activation can lead to unexpected persistence, nuisance automation, and collection of personal progress data.
The skill sets up scheduled proactive daily messages and stores user progress in memory, but the description does not prominently warn users about these behaviors at the point of installation/use. This undermines informed consent and can surprise users with ongoing monitoring-like interactions and retained behavioral data they did not realize would be stored.
The trigger phrase "check in" is generic everyday language and can easily activate this skill in unrelated conversations, causing unintended invocation. In a skill that stores progress in memory and is designed for recurring behavioral check-ins, accidental activation can lead to confusing state changes, privacy issues, or unwanted automation flows.
The trigger "打卡" is extremely common in Chinese and is used across many contexts, not just this skill. That makes accidental routing likely, especially because this skill performs memory-based check-in behavior and could respond when the user meant a different app, workflow, or casual statement.
The short trigger "打卡" is overly broad and may match many unrelated user inputs. Although this appears in metadata rather than executable code, trigger collisions can still cause unintended skill activation and inappropriate access to the skill's memory-driven workflow.
This trigger is informal and could overlap with many general productivity or assistant requests rather than uniquely identifying this skill. The file does not narrow activation context enough to distinguish this phrase from ordinary user speech.
No suspicious patterns detected.
