Security audit
Security checks for vulnerabilities and agentic risk
This lottery helper is low-impact and transparent about its commands and local storage, but some commands appear buggy or incomplete.
This skill looks safe to install from a security perspective, but treat it as a simple and possibly unfinished helper: verify generated picks and do not rely on its check, history, or stats commands for accurate lottery validation.
The manifest says the skill can check results, but the cmd_check function only echoes the provided inputs instead of comparing numbers or determining any match outcome. This is a direct mismatch between the claimed purpose and the actual implemented behavior.
The manifest frames the skill as a generator/checker for lottery draws, which implies ephemeral number generation and result comparison. The script creates a local data directory and implements history/stats features, expanding behavior into local data storage and tracking that is not reflected in the stated description.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
DATA_DIR="$HOME/.local/share/lottery"
mkdir -p "$DATA_DIR"
#
#
#
#
For a skill described as generating lottery numbers and checking results, maintaining and exposing historical pick logs and aggregate stats is not an obvious requirement. This introduces a stateful tracking capability beyond the manifest's narrow user-facing purpose.
No suspicious patterns detected.