Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent 90-day personal planning skill with no executable code or hidden network behavior, though users should know it may save a local Markdown plan containing personal details.
Install only if you want a Chinese-language 90-day planning assistant. Before letting it save output, choose a filename and location that do not expose personal details unnecessarily, especially because the plan may include your goals, obstacles, work habits, and self-assessment.
The entire skill description, triggers, workflow, and output template are presented only in Chinese, with no indication that users may choose another language. This can constitute a language-policy issue because it implicitly forces a specific language without opt-in or documented regional justification.
The trigger phrases include very common conversational language such as '给我制定计划', '不知道从哪里开始', and '我想改变但不知道怎么做', which can cause the skill to activate unintentionally in unrelated contexts. This can lead to inappropriate takeover of conversations, unexpected planning behavior, and collection of personal context that the user did not intend to provide to this specific skill.
The skill instructs the agent to write a Markdown file by default using a filename that includes the user's name, but it provides no notice, consent step, or data-handling warning. This creates privacy and data-retention risk because personal information and self-assessment details may be stored locally or persist beyond the session without the user's informed approval.
The default prompt is written only in English even though the display name and description are in Chinese, which implies a language preference mismatch. This can amount to a language/locale policy issue because the skill appears to impose English interaction without offering the user a choice or documenting the constraint.
