Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a legitimate home-maintenance record keeper, but it will save home, contractor, warranty, and cost details locally for future use.
Install this only if you are comfortable with the agent maintaining a local household record that may include addresses, appliance models, contractor contact information, warranty dates, service notes, and repair costs. Avoid sharing details you do not want saved, and periodically review or delete the local home-data.json file if your household records change or the machine is shared.
The skill is configured to trigger on very broad, casual home-related phrases, which increases the chance it activates during ordinary conversation that was not intended to be persisted as structured household data. In this skill's context, that can lead to over-collection and unintended storage of sensitive information such as addresses, appliance details, service history, and contractor records.
The skill persistently stores detailed household records in a local JSON file, including property identifiers, addresses, appliance inventories, warranties, maintenance history, contractor contact data, and spending information, without any user-facing notice or consent language. While this is core functionality, the absence of transparency and minimization controls makes accidental collection and retention of sensitive home data more dangerous.
The eval explicitly requires writing identifiable household and contractor information to home-data.json and reading it across sessions, but it provides no user notice, consent flow, retention limits, or access controls. In a home-maintenance skill, this data can reveal occupancy, appliance inventory, service providers, and phone numbers, creating privacy and security risks if stored unexpectedly or exposed to other users, tools, or logs.
The file contains a natural-language instruction, 'Never use em dashes,' which forces a specific stylistic convention rather than adapting to user preference. While not a locale restriction, it is an organizational language-style constraint applied unconditionally in the skill's instructions.
The eval explicitly expects the skill to write appliance and warranty-related information to a persistent data file without any indication that the user is informed or has consented to storage. While this is operationally normal for a home-maintenance skill, silent persistence of household asset details can expose sensitive information about the property, installed systems, and warranties if users do not realize the data is being retained.
