Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple study-plan helper with minor documentation and language limitations, not a security threat.
Install this if you want a mostly Chinese-language study planner. Be aware that one helper script stores local task entries in a study-plan data folder and that some task-management commands appear incomplete or demo-like rather than fully functional.
The description says "Use when you need study plan capabilities. Triggers on:." but does not provide any actual trigger phrases or constraints. This leaves activation scope unclear and could cause unintended invocation because there are no specific trigger examples or exclusion conditions.
The help text advertises state-changing task-management commands such as 'done', 'priority', 'remind', and 'clear', implying they affect the underlying study plan data. However, the corresponding implementations at L047-L080 only echo status text and append to history.log, while leaving the main data file unchanged, which contradicts the documented behavior of those commands.
This shell/Python skill presents its title, help text, commands, and generated content entirely in Chinese, indicating a fixed language experience. The file does not offer a language choice or explain that it is intentionally limited to a Chinese-speaking or region-specific context, which matches the locale-policy violation criteria.
The natural-language description mixes Chinese and English, but there is no statement that the skill will adapt to the user's preferred language or ask for language choice. This can create a language/locale policy concern if the skill defaults to a language without explicit user opt-in.
In the help text, 'export' suggests a dedicated export capability, typically implying conversion or writing data to an export target. The implementation at L082-L085 merely cats the existing data file to standard output, which is materially different from the documented intent of an export command.
The file's substantive guidance is written in Chinese, which imposes a specific language on users without any stated opt-in or alternative locale option. Under the policy, forcing a specific language without user choice is a natural-language policy concern.
No suspicious patterns detected.
