Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese-language goal tracker that writes goal data to JSON files and has no evidence of network access, credential use, hidden execution, or exfiltration.
Install only if you are comfortable with a Chinese-language local goal tracker storing goals in files beside the skill. Be careful with delete or cancel requests because matching goals may be removed without a confirmation step.
The README is written entirely in Chinese and provides examples only in that language, without indicating multilingual support or giving users a language choice. This can lead to accessibility and usability issues, causing users or downstream systems to assume a fixed language mode and mishandle requests from users in other languages.
The example triggers are generic everyday phrases such as setting goals, updating progress, and doing a monthly review. Because they closely overlap with normal user requests, the skill may activate unintentionally or be selected in contexts broader than intended, which can cause misrouting, confusion, or inappropriate handling of user input.
The entire skill interface, trigger phrases, commands, and examples are specified only in Chinese, with no indication that users may choose another language or opt in to a locale-specific experience. This can violate language/locale policy when a skill implicitly forces one language without user choice or documented justification.
The skill advertises a destructive 删除 [目标名] command but provides no confirmation step, undo mechanism, or warning about permanent data loss. In a goal-tracking skill that stores user data in local files, ambiguous or accidental invocation could erase records and reviews unexpectedly.
The function save_reviews is documented as saving review data, and the module advertises review/tracking features, but no code path calls save_reviews and generate_review only returns a formatted string without storing any review content. This creates an intent-code divergence where the code suggests persisted review management exists, but actual behavior only generates a template.
The delete path removes goal data immediately based on a natural-language query substring match and persists the change without confirmation, preview, or undo. In an agent setting, ambiguous phrasing, prompt injection, or accidental invocation could cause irreversible loss of user data, especially because deletion criteria are broad and silent.
The module description, templates, command examples, and all user-facing responses are written in Chinese, effectively forcing a specific language for interaction. The file does not provide an opt-in language selection mechanism or a documented justification for the locale restriction.
The comment 确定存储位置 implies goals are stored according to their duration category, but the implementation places all non-yearly and non-quarterly goals, including half_year, into monthly_goals. This is a direct mismatch between the documented intent of duration-based storage and the actual categorization logic.
No suspicious patterns detected.
