Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent memory-migration tool, but it directs agents to read and rewrite persistent memory and agent-instruction files without clear consent, review, or backup steps.
Install only if you want this skill to reorganize your workspace memory system. Before using it, review the planned changes to AGENTS.md, MEMORY.md, SOUL.md, USER.md, and memory daily files, make a backup or commit first, and avoid granting broad tool permissions unless the specific file changes are clear.
The skill description is written in Chinese and does not indicate that other languages are supported or that the language requirement is optional. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is clearly documented and justified.
The skill explicitly instructs the agent to read and restructure memory-related files such as AGENTS.md, SOUL.md, USER.md, MEMORY.md, and daily logs, which are likely to contain sensitive personal preferences, relationship notes, and historical context. In a skill whose purpose is memory migration this access is functionally relevant, but the lack of any privacy warning, consent checkpoint, or data-minimization guidance makes it a real privacy and data-handling weakness rather than a false positive.
The skill directs the agent to rewrite AGENTS.md and MEMORY.md and later create or normalize daily memory files and templates, causing persistent workspace changes. Although these modifications are central to the installation workflow, the skill does not require a clear warning, backup, dry-run, diff review, or user approval before destructive edits, creating risk of unintended data loss, policy changes, or privacy-impacting persistence.
This markdown file is written entirely in Chinese, beginning at the section headings and continuing through all operational guidance. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and this document does not offer an alternative language or explain that the Chinese-only format is required for a justified region-specific use case.
This file is a markdown document, so natural-language policy checks apply. The phrase "small first，need-based expansion" is presented as the core principle without offering a language choice or explaining why English is required, which may conflict with a language/locale policy that avoids forcing a specific language absent user opt-in.
No suspicious patterns detected.
