Security audit
Security checks for vulnerabilities and agentic risk
This Pomodoro skill is a simple terminal timer with disclosed optional local notification and session logging behavior.
Before installing, be aware that notifications rely on macOS osascript and the optional logging command stores focus-session timestamps in ~/pomodoro.log. Avoid using the logging command if you do not want that local activity trail.
The stated purpose is to run timed focus sessions from the terminal, but the implementation also invokes a platform-specific GUI notification mechanism through osascript. While related to timer completion, this is an extra execution capability not clearly justified by the narrow manifest wording.
The manifest frames the skill as a terminal timer for Pomodoro sessions, which implies running timers and displaying status, but this section adds persistent file-writing behavior by appending to ~/pomodoro.log. Logging may be useful, yet it expands the behavior beyond the narrow description of simply running timed focus sessions.
The skill writes persistent activity data to ~/pomodoro.log without warning in the manifest or description, which can surprise users and create an unintended privacy trail of work habits and timestamps. While low severity, undisclosed persistence is security-relevant because it stores behavioral metadata in the home directory that other local processes or users may later access.
No suspicious patterns detected.
