Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local document-archiving workflow, but users should treat its OCR and timeline outputs as sensitive personal records.
Install this only for archives where you are comfortable creating searchable OCR text and metadata. Keep the output in a private or encrypted location, avoid cloud OCR unless you explicitly approve sending the documents out, and review uncertain screenshots before deleting or permanently archiving them.
The skill describes a wide applicability scope for archiving many kinds of personal documents and records, but it does not define specific invocation triggers, boundaries, or exclusion conditions beyond general purpose text. This ambiguity could cause the skill to be invoked for loosely related document-management tasks that the user did not intend.
The retention rules for APP screenshots include subjective conditions such as '有价值' and content that may not be findable later, without defining concrete thresholds. These broad natural-language criteria can lead to inconsistent or unintended application of the skill's workflow.
The skill instructs generating .ocr.md sidecar files containing full OCR text and structured metadata for receipts, contracts, policies, and transaction records, but it does not require privacy controls for extracted sensitive content. Even though the intro claims desensitized rules, the operational steps explicitly persist raw extracted text locally, which can expose account numbers, addresses, policy IDs, or other personal data through filesystem search, sync tools, backups, or secondary indexing.
The natural-language instructions and description are fully Chinese, which effectively imposes a language constraint on users and maintainers. There is no stated opt-in, alternative language support, or justification that this skill is intended only for a Chinese-language environment.
The timeline index stores extracted dates, counterparties, and document types in a centralized searchable file without warning about privacy implications or minimizing retention. Aggregating this metadata creates a concise activity ledger that may reveal financial relationships, purchases, institutions, and life events even if the original documents are harder to access individually.
