Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple local habit tracker with disclosed JSON persistence and no evidence of hidden, networked, credential, or destructive behavior.
Install this if you are comfortable with habit names and check-in dates being stored locally in a JSON file. Be aware that broad trigger words may invoke it when you did not specifically intend habit tracking, and non-Chinese users may need translation or localization changes.
The activation trigger list includes very broad terms such as “习惯” and possibly generic check-in words like “打卡/签到”, which can cause the skill to activate in many unrelated conversations. Overbroad triggers increase the chance of unintended invocation, causing surprising behavior and possible leakage of user intent or local state into the wrong context.
The description is presented only in Chinese and the examples/output strings throughout the file are fixed to Chinese, with no indication that the user can choose another language. This can violate a language/locale policy when skills must not force a specific language without opt-in.
No suspicious patterns detected.
