Security audit
Security checks for vulnerabilities and agentic risk
The skill sends desktop notifications, but its recommended setup persistently changes global agent memory so future conversations run a command after every response.
Install only if you are comfortable with a setup step that changes ~/.workbuddy/MEMORY.md so every future conversation may run a notification command after each response. Prefer using the notify scripts manually, or require the publisher to replace the global memory edit with an explicit, reversible, per-skill setting and to harden the macOS osascript argument handling.
scripts/setup.sh:8Persistent Global Agent Memory Poisoning Through Setup Scripts
scripts/notify.sh:7AppleScript Injection Through Unescaped Notification Arguments
The skill is described as a notification helper, but it also promotes a setup step that persists behavioral rules into ~/.workbuddy/MEMORY.md for all future conversations. That creates a hidden scope expansion from one-shot notifications to durable cross-project agent behavior, which can surprise users and weaken consent boundaries around persistent configuration changes.
The skill is described as a notification helper, but it also promotes a setup step that persists behavioral rules into ~/.workbuddy/MEMORY.md for all future conversations. That creates a hidden scope expansion from one-shot notifications to durable cross-project agent behavior, which can surprise users and weaken consent boundaries around persistent configuration changes.
Referenced artifact was not completely inspected
- `SKILL.md`（本文件）
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# desktop-notify 一键全局配置 (Windows)
# 作用：把"每次回答完自动发通知"规则写入用户级全局记忆 ~/.workbuddy/MEMORY.md
# 运行一次即可，之后所有对话全局生效。可重复运行，不会重复写入。
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# desktop-notify 一键全局配置 (Windows)
# 作用：把"每次回答完自动发通知"规则写入用户级全局记忆 ~/.workbuddy/MEMORY.md
# 运行一次即可，之后所有对话全局生效。可重复运行，不会重复写入。
This setup script does more than configure desktop notifications: it persists a new global behavioral rule into the agent's user-level MEMORY.md so future conversations automatically execute a notification command after every response. That is a cross-session behavior modification mechanism, which exceeds the stated purpose of a notification skill and creates a persistence channel for hidden instructions affecting the agent globally.
The script targets the user's global .workbuddy/MEMORY.md and prepares to modify it so the agent follows a mandatory command in future interactions. For a desktop notification helper, changing user-level global memory is unjustified and dangerous because it establishes durable influence over unrelated projects and conversations.
The script extends a narrowly described task-end notification helper into a persistent global rule that affects all future conversations by writing to ~/.workbuddy/MEMORY.md. This is dangerous because it changes agent behavior outside the declared scope of the skill and creates hidden, durable side effects that the user may not expect or consent to.
The script writes a policy-like instruction into a user-global memory file, giving this notification skill the ability to influence all future assistant responses. For a desktop notification helper, this is an unjustified privilege escalation in scope and persistence, and it can be abused to implant durable behavioral rules unrelated to the skill's stated purpose.
The documentation broadens the skill from transient task-completion notification into persistent global configuration of assistant behavior. Even if user-invoked, this is security-relevant because it changes future execution context outside the immediate task and can normalize hidden persistence in a skill that appears harmless.
The setup instructions recommend a command that changes global behavior across future conversations before adequately foregrounding the persistence and cross-project impact. Users may execute it as a routine install step without understanding they are altering long-term assistant behavior, which is a meaningful consent and safety issue.
A desktop notification helper does not need the capability to modify a user global memory/configuration file to fulfill its core function. Adding that capability increases attack surface and creates an opportunity for policy persistence or future prompt/agent manipulation under the cover of a benign utility.
The manifest description is entirely in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific audience. The policy requires either user choice or clear documentation of a justified locale constraint.
The file's user-facing comments and the rule written into MEMORY.md are entirely in Chinese and prescribe ongoing behavior without indicating that language is configurable or region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.
The script appends a global rule directly into MEMORY.md without presenting a confirmation prompt or clearly summarizing that it will affect all future conversations. Silent persistence increases the risk of users unknowingly changing agent behavior and makes abuse harder to detect or attribute.
The comments frame the script as simple desktop-notify setup, but it actually installs an always-notify global rule for future dialogues. This mismatch is dangerous because misleading documentation reduces informed consent and makes users more likely to run a script that has broader effects than advertised.
The file's user-facing natural language is entirely in Chinese and the script injects Chinese notification text into the global memory rule. This imposes a specific language/locale choice without offering the user an opt-in or alternative, which matches the language-policy concern defined for this audit.
The script silently creates and modifies a user-global memory file without prompting, warning, or showing the user the exact change beforehand. Silent policy changes are risky because they can alter future assistant behavior in ways the user does not notice, making persistence and recovery harder.
The natural-language instructions and examples are entirely in Chinese, and the file does not indicate that other languages are supported or that Chinese is optional. Under the policy, forcing a specific language without opt-in can be a locale-policy issue unless the constraint is explicitly justified.
Line L58 states '无网络、无文件读取（除写自己的 MEMORY.md）', asserting no file reading while simultaneously documenting a write to MEMORY.md. Elsewhere, L39-L55 makes clear the setup process edits ~/.workbuddy/MEMORY.md, so the wording understates the actual file-system side effect and can mislead readers about the skill's behavior. Even though it carves out an exception, the headline claim conflicts with the documented persistence behavior.