Security audit
Security checks for vulnerabilities and agentic risk
This is a simple habit check-in skill with disclosed local storage, but it should be clearer about broad triggers and the unrelated video notes in its documentation.
Before installing, be aware that habit check-ins may be stored persistently in a local JSON file. Prefer using the explicit habit-checkin trigger and remove the unrelated B站 notes if you want cleaner, less confusing skill documentation.
The documentation discloses that data is stored in a local JSON file, but it does not warn users that their check-in history will persist on disk. In a habit-tracking context, this can expose behavioral data to other local users or create privacy surprises, especially when combined with broad triggers that may record activity unintentionally.
The trigger phrases include very common expressions such as 打卡, 签到, 今天打卡, and check in, which can occur in ordinary conversation outside the intended habit-tracking context. This can cause unintended invocation of the skill, leading to unexpected writes to the local habit data file and confusing or privacy-impacting behavior.
The manifest and earlier documentation describe a simple habit tracking skill for daily check-ins and streak counting, but lines L30-L63 switch to 'B站学习' content listing unrelated videos and download-link resources. This is not merely extra detail; it actively changes the apparent intent of the file from skill documentation to media/resource curation unrelated to habit tracking.
No suspicious patterns detected.
