Security audit
Security checks for vulnerabilities and agentic risk
The skill provides personal coaching with optional local history, with minor cautions about conversation triggers and irreversible record deletion.
Saved history is readable local JSON. Approve only information you want retained, and back up important records before deletion because there is no built-in undo. Generic greetings may reopen saved priorities. Maintainer publishing commands are unnecessary for normal use.
scripts/record.pyDestructive record deletion has no executable confirmation gate
An unconfirmed helper invocation can irreversibly remove saved coaching history or session summaries. The demonstrated scope is limited to this Skill's local stores; explicitly authorized deletion remains normal functionality.
The supplied command invokes operational release/download functionality that is neither declared nor evidently a supporting implementation detail of the coaching purpose. The script implementation is not supplied, so its exact data access, network activity, and side effects cannot be established.
The visible commands concern release-monitoring reports rather than personal prioritization or coaching. This is an undeclared, materially different capability. The script implementation is not supplied, so additional behavior such as network access cannot be established.
The supplied command concerns release/download monitoring rather than coaching, prioritization, or habit support. Nothing in the declared purpose explains this capability as a supporting implementation detail. The mismatch is evident from the invocation, although the underlying script's specific behavior remains unknown.
The supplied command runs scripts/release_monitor.py report --verbose rather than providing personal coaching. Release monitoring is not a declared capability or an evident supporting implementation detail of the described coaching function. The script's implementation is not supplied, so its specific data access and side effects cannot be determined.
The supplied command performs release-monitoring bookkeeping rather than helping a user prioritize or take a small action. Its explicit operation and download-count argument indicate a separate maintenance/metrics capability, not merely an implementation detail of a coaching interaction. The script itself is not supplied, so network access, storage behavior, and other side effects cannot be determined.
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The publication command uses npx clawhub@latest, which resolves a mutable package version and executes it with the maintainer's permissions. A compromised future release could access publishing credentials, modify release contents, or execute arbitrary code; however, this is an optional maintainer workflow rather than normal coaching behavior, which limits exposure. The finding's MCP-server characterization is unsupported, but the underlying unpinned executable dependency risk is valid.
Phrases such as “我准备开始了” (“I'm ready to start”) and “我有点拖” (“I'm procrastinating a bit”) can occur in many unrelated conversations. The activation list does not require an established daily-planning workflow or provide exclusions, so these phrases could unintentionally invoke morning_start.
“我回来了” (“I'm back”) and “接着上次” (“continue from last time”) can refer to any conversation, not specifically a mainline or priority review. Requiring user initiation does not disambiguate these phrases, so ordinary conversation could unintentionally activate the record-reading and resumption workflow.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
if not legacy.exists():
write_store(kind, empty_store(kind))
return f"{kind}: 未发现旧数据，已初始化新路径：{primary}"
shutil.copy2(legacy, primary)
data, _ = load_store(kind)
if items_key not in data:
data[items_key] = []
Triggers such as “我回来了” (“I'm back”), “我准备开始了” (“I'm ready to start”), and “我太累了” (“I'm too tired”) occur commonly outside priority coaching. The routing rules direct immediate state selection on a match without requiring an established coaching context or distinguishing unrelated uses, which can cause unintended routing.
No suspicious patterns detected.