Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Chinese-language companion/recommendation skill with no evidence of hidden execution, exfiltration, persistence, or privilege abuse.
Installers should understand that this is a Chinese-language companion-style skill and should avoid sharing sensitive personal information unless they are comfortable with how their agent handles conversation history; review any external GitHub clone or npm install target before running it.
The primary natural-language description is presented only in Chinese and describes the skill's companion behavior without indicating that language is optional or limited to a justified locale-specific audience. Under the policy rule, language constraints should either be opt-in or clearly documented as region-specific.
The skill is framed as a broad companionship and general-chat agent rather than a narrowly scoped utility, which can lead to uncontrolled activation scope and unclear safety boundaries. In a companion context that encourages open-ended conversation and recommendations, this increases the chance of mishandling sensitive topics, overcollection of user data, or performing actions beyond what users reasonably expect.
The statement that the skill 'remembers user preferences' implies storage or reuse of personal behavioral data, but the file provides no disclosure about what is retained, for how long, or with what protections. In a companion-style skill, preference memory can easily include sensitive entertainment habits, emotional disclosures, and linked content, creating privacy and consent risks if users are not clearly informed.
The file’s natural-language descriptions and CLI usage are entirely in Chinese, presenting the skill as a companion chatbot for general use without any indication that language is configurable or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The changelog and vision content use Chinese language exclusively, including feature descriptions and the project vision. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no justification or alternative is provided.
The natural-language skill description and examples are entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific audience. This can constitute a language/locale policy issue when a skill appears to force a language without user opt-in.
No suspicious patterns detected.
