Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly stays local, but its advertised Terms of Service purpose does not match one shipped command script that silently persists user-provided text and command history.
Review before installing if you expect only a Terms of Service generator. The TOS template script is local and includes a legal disclaimer, but another bundled command stores arbitrary text and history under your home data directory. Do not enter secrets or sensitive business data into the add/search commands, and explicitly set the governing law rather than relying on the default.
The command name and user-facing output say an item was removed, but the function only prints a message and appends to history.log. It never edits or deletes content from the main data store at $DB, so the documented intent directly contradicts the actual behavior.
The manifest says the skill should be used 'when you need terms of service capabilities' and later says it is for '任何需要terms of service的人', which is a very broad activation condition without clear boundaries or exclusions. Although 'terms of service' is somewhat domain-specific, the file does not define specific trigger phrases, scope limits, or negative examples to distinguish when this skill should or should not activate.
The natural-language description and FAQ present the skill in Chinese and English, but there is no statement telling users what language output will default to or offering them a choice. This can violate language/locale policy expectations because the skill appears to impose a locale presentation style without explicit user opt-in.
The file identifies itself as "terms-of-service" and presents itself under that name in help output, which suggests functionality related to terms-of-service handling. However, the documented commands and corresponding code implement generic local operations like add/list/search/export against a simple log file, not any terms-of-service-specific behavior.
The helper function writes command names and user-supplied arguments to a persistent history file under the user's home directory with no notice, consent prompt, or minimization. This can expose sensitive strings typed by users, such as search terms or operational notes, to other local processes or future users of the account.
The add command persists arbitrary user-provided content directly to disk, which may unintentionally capture secrets, personal data, or other sensitive material without warning. In a skill context, users may assume transient command behavior, so silent persistence increases privacy and data-retention risk.
The help text sets the default governing law to the People's Republic of China, which imposes a specific locale/legal regime by default. Under the policy, forcing a specific locale without opt-in is a natural-language policy concern unless the tool is clearly documented as region-specific, which this script is not.
The script hard-codes a default governing-law jurisdiction of the People's Republic of China into generated terms without requiring explicit user confirmation. In a legal-document generator, this can silently produce materially incorrect contractual terms that users may deploy unknowingly, creating compliance, enforceability, and business-risk exposure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
(d) Interfere with or disrupt the Service or servers
(e) Use automated systems (bots, scrapers) without permission
(f) Impersonate any person or entity
(g) Collect personal information of other users without consent
(h) Use the Service to send spam or unsolicited messages
(i) Circumvent any access controls or security measures
(j) Use the Service in a manner that could damage our reputation
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
(d) Interfere with or disrupt the Service or servers
(e) Use automated systems (bots, scrapers) without permission
(f) Impersonate any person or entity
(g) Collect personal information of other users without consent
(h) Use the Service to send spam or unsolicited messages
(i) Circumvent any access controls or security measures
(j) Use the Service in a manner that could damage our reputation
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
--------------------------------------------------------------------------------
8.1 THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES
OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO
IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, AND NON-INFRINGEMENT.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
--------------------------------------------------------------------------------
8.1 THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES
OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO
IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, AND NON-INFRINGEMENT.
No suspicious patterns detected.