Security audit
Security checks for vulnerabilities and agentic risk
This is a simple reminder-formatting skill with minor over-triggering risk but no evidence of hidden or harmful behavior.
Before installing, be aware that the skill may activate on broad scheduling language and may misread ambiguous lunar-calendar tokens. Review or install the referenced lunar-convert skill separately if you plan to use lunar-date reminders.
The skill's trigger scope is intentionally very broad, including generic scheduling/reminder phrasing and even any message describing a future task with a time. This can cause accidental invocation on messages that are not actually reminder-creation requests, leading to misrouting, unintended data transformation, or downstream actions being prepared without clear user intent.
The lunar-date detection uses very short and ambiguous tokens such as 'âm', 'AL', and similar fragments, which are prone to matching unrelated user text. That can spuriously invoke the lunar-convert skill, increasing the chance of incorrect date conversion, unintended skill chaining, and user-confusing outputs.
The description states the skill operates 'in any language (Vietnamese or English),' which effectively limits supported languages to two without user opt-in or a documented justification. This is a language/locale policy concern because it imposes a specific language scope rather than offering a user choice or clearly stating region-specific rationale.
