Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-language wellness reminder skill with no hidden code, exfiltration, or destructive behavior found.
Before installing, confirm you want recurring meal, hydration, exercise, and weekly report reminders, adjust the Asia/Shanghai timezone if needed, and treat the diet guidance as general wellness advice rather than medical advice. Users with pregnancy, breastfeeding, diabetes, eating-disorder risk, or other medical needs should consult a clinician.
The description is written entirely in Chinese and centers the skill around Chinese dietary guidance, but it does not state that the skill is China-specific or offer any language choice. This creates a locale/language policy issue because users are implicitly forced into a specific language and regional standard without opt-in.
The skill configures reminders using the fixed timezone "Asia/Shanghai" for hydration reminders, and the document does not explain that this is limited to that region or allow user choice. Hard-coded locale behavior without opt-in can violate language/locale policy expectations.
All scheduled meal, follow-up, hydration, exercise, and weekly report reminders use the fixed timezone "Asia/Shanghai". Because the skill does not present this as a region-specific tool or ask the user to confirm their locale, it imposes a specific regional setting by default.
SKILL.md 在目标模式和四季晚餐方案中多次允许‘晚餐可不吃’或‘轻食/不吃’（如 L065、L092、L111、L130、L149），体现的是围绕晚餐选择的饮食建议。而 L231 的晚餐 cron 文案额外加入‘提醒睡前3小时不进食’，这与文件前文实际建议的晚餐时间 18:30 及可不吃晚餐的设定并不一致，属于文档内部对技能意图的主动冲突。
文档前文在四季下午茶中明确提供水果、温补、零食等可食用选项，并说明每个饭点从对应池中选 3 个方案 ABC 供选择（如 L087、L106、L125、L144）。但 L233 的 cron 文案要求‘遵循 只喝不吃，馋了就喝水’，直接否定了这些已列出的下午茶食物方案，属于明确的意图与实现提示词冲突。
