Security audit
Security checks for vulnerabilities and agentic risk
This is a small offline Hebrew text utility with some accuracy and activation-scope caveats, but no hidden access, persistence, network behavior, or destructive capability.
Before installing, understand that this skill may activate for broad Hebrew-related prompts and its transliteration is Ashkenazi-style only, with a known Tav mapping accuracy issue. From a security perspective, it stays local and does not request sensitive access.
The listed triggers include very broad phrases such as "gematria," "hebrew letters," and especially "hebrew text," which can overlap with ordinary discussion rather than a clear request to invoke the skill. The manifest does not provide exclusion conditions or tighter context to distinguish when the skill should activate versus when Hebrew is merely being discussed.
This code explicitly declares an "Ashkenazi-style" transliteration mapping, which imposes a specific linguistic convention on all users. Under the policy, forcing a particular language or locale variant without offering a choice can be a natural-language policy violation.
The mapping first assigns 'ת' to 't' and then reassigns the same key to 's', so Python keeps only the later value. This directly contradicts the inline comment on L071 stating to keep 't' for Ashkenazi, creating an intent-code divergence in a core advertised feature.
The documentation states that transliteration uses "Ashkenazi-style pronunciation," which enforces a specific language/locale convention. The file notes in limitations that Sephardi variants are not supported, but it does not offer user choice or explicit opt-in for this style.
The manifest and module docstring present this as a Hebrew text utilities skill focused on transliteration, gematria, nikud removal, letter identification, and number formatting. The additional reverse() capability is a separate text transformation not reflected in the stated scope, and it is exposed as a CLI feature.
