Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local daily and weekly report generator, but users should be aware it automatically saves workplace notes into files.
Install this if you want a Chinese daily or weekly report assistant that saves Markdown reports locally. Before using it, assume your report may contain confidential project, deadline, personnel, or incident details; review and redact sensitive content, and verify the save path before keeping files in a synced, shared, or version-controlled workspace.
The natural-language instructions, examples, and usage are all presented in Chinese, and the invocation examples assume Chinese interaction. There is no opt-in, alternative language option, or statement that the skill is intentionally limited to a Chinese-speaking context.
The README explicitly says generated reports are automatically saved into workspace files, but it does not warn that users may include sensitive workplace information such as project details, bugs, deadlines, management plans, or internal issues. In a reporting skill, that omission matters because users are encouraged to provide exactly the kind of confidential content that should be handled carefully, increasing the risk of inadvertent data exposure through synced folders, commits, backups, or shared workspaces.
The usage section says to invoke the skill by telling the AI phrases like "帮我生成今天的日报" and "帮我生成这周的周报" without any additional context, scoping, or exclusion conditions. These are natural conversational requests that could easily appear in ordinary chat, making activation boundaries unclear and increasing the risk of unintended invocation.
The skill states that the AI will automatically generate and save a report to a filesystem path without warning the user or obtaining explicit consent for the write. That creates an unsafe side effect: a normal chat request can unexpectedly modify the workspace, which can lead to unwanted file creation, privacy issues, or cluttering/logging sensitive work notes in persistent storage.
The embedded 'AI SYSTEM DIRECTIVE' is a stronger red flag because it attempts to compel the assistant to save reports automatically as a mandatory action. Mandatory auto-write behavior increases risk by removing user choice and making persistence happen as part of ordinary conversation, which is especially problematic when reports may contain sensitive workplace information.
