Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed local team-task ledger with optional macOS Reminders mirroring and opt-in scheduled sync, with sensitive behavior scoped and documented.
Install only if you want a Chinese-language local team-task ledger with optional macOS Reminders mirroring. Treat --initialize-mirror and --enable as meaningful local changes: they can access a dedicated Reminders list, write local state files, and create a user LaunchAgent until disabled. Keep the data/state directories private to the user and use a trusted integration layer for identity, permissions, notifications, and any government-calendar web access.
声明描述的是一个以 team-tasks 为中心的任务管理与提醒同步组件，而代码的主职责是管理年度日历数据文件。代码中只有 calendar 的 validate/install 逻辑：读取和校验日历文档、合并检查冲突、文件锁、权限/所有权安全检查、mkstemp+hard link 的原子写入、目录 fsync，以及 CLI 参数处理。它不涉及任务对象、评论、归档、备份、恢复、提醒事项 API、调度事件或外部适配器交互。虽然声明中提到使用内置中国大陆年度工作日日历，但该代码只是底层日历文件安装器，不是所声明技能的整体行为，因此描述与实际代码存在明显且实质性的不匹配。
代码片段是 tests/test_calendar_manager.py，测试对象明显是 calendar_data / calendar_manager 脚本，职责围绕年度节假日与调休日历 JSON 的安全安装和验证。它处理的资源是 calendar-dir 下的 YYYY.json 文件，并验证原子写入、文件锁、并发、冲突、符号链接、FIFO、防损坏输入等文件系统行为。声明则描述了一个 team-tasks 任务台账技能，核心对象应是任务、评论、归档、备份恢复及提醒事项同步。两者的主要目的、数据模型、接口能力和外部集成对象都明显不同。虽然声明中提到“使用内置中国大陆年度工作日日历”，但该代码仅体现日历管理本身，缺少与任务系统结合的功能，因此属于显著描述与行为不一致。
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
"""Transfer location, preserving identity and all native and ledger state.
Only the binding is committed, last and atomically. A crash during archive
creation leaves the old binding active; retry never needs to delete state.
"""
binding = state.read_binding()
if binding is None:
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
raise ValueError('dynamic must be boolean')
if 'oneShot' in rule and type(rule['oneShot']) is not bool:
raise ValueError('oneShot must be boolean')
return rules
def report(data_dir, rules):
The skill describes and encourages execution of multiple local scripts, file-system writes, macOS reminders synchronization, optional government-web access for calendar maintenance, and shell commands, but it does not declare an explicit tool/permission scope. In an agent environment, missing scope boundaries can let the runtime grant broader-than-intended file, shell, or network access, increasing the chance of unauthorized writes, command execution, or data exposure beyond the intended data directory.
The file title and the full operational instructions are written entirely in Chinese, and the reusable prompt hardcodes Chinese-language task phrasing. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The document specifies that when both dueDate and dueTime are present, reminders are written using the fixed Asia/Shanghai (+08:00) timezone regardless of the host timezone. If the user, device, or teammates operate in other timezones, this can silently shift deadlines and reminder times, causing missed or premature task actions. In a task-management and reminder-sync skill, time interpretation directly affects operational behavior, so the risk is real rather than cosmetic.
The file explicitly requires the timezone to be set to Asia/Shanghai, which imposes a locale-specific setting in natural-language instructions. The document does not present this as an optional user choice or clearly justify the skill as region-specific, so it may violate language/locale policy constraints.
The document provides concrete commands and procedures to enable persistent scheduled background execution (including LaunchAgent installation and periodic wake-ups) but does not prominently require an explicit user warning/confirmation about ongoing system modification and recurring execution. Even if intended for legitimate sync, this increases the risk of users enabling durable background behavior without fully understanding persistence, permission prompts, resource use, or how to disable it.
L31 明确要求内置日历统一使用 Asia/Shanghai，并在后文要求维护助手读取政府公告，整体行为绑定到中国地区规则。作为自然语言策略问题，文档没有说明这是仅面向中国地区/中文场景的专用技能，也没有提供用户选择其他语言或地区设置的方式。
This file’s natural-language instructions, examples, and operational guidance are entirely in Chinese, which can impose a specific language on users or operators. The policy allows locale constraints only when clearly documented and justified or when users are given a choice, neither of which is stated here.
The file hard-codes Asia/Shanghai as the timezone and later requires calendar documents to use that locale-specific value. The stated policy flags language or locale constraints when they are forced without user opt-in or clear justification; this file contains the constraint in code but does not document user choice within the file.
This code contains multiple user-facing messages in Chinese, such as directory validation errors, and later CLI help text and result codes are also presented in Chinese. Because the file does not indicate that the skill is explicitly region-specific or provide a language/locale opt-in, this appears to violate the language-choice policy.
This code defines the reminder list name and multiple status labels in Chinese, and later builds reminder bodies and many user-facing messages in Chinese only. The file provides no user opt-in, language selection, or documented region-specific requirement, so it appears to force a locale in violation of the language/locale policy.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
os.chmod(payload, 0o600)
json.dump(request, stream, ensure_ascii=False, allow_nan=False)
try:
result = subprocess.run(['/usr/bin/osascript', '-l', 'JavaScript', str(BRIDGE), str(payload)],
capture_output=True, text=True, timeout=15 if request.get('mode') == 'probe' else 120, check=False)
except subprocess.TimeoutExpired as exc:
raise SyncError('macos_probe_timeout' if request.get('mode') == 'probe' else 'macos_sync_timeout',
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
raise SyncError('macos_sync_lock_timeout', '目标列表正在同步')
time.sleep(.05)
try:
stack.enter_context(sync_lock(state.root, timeout=0 if scheduled else 30))
state.check_ledger_binding()
yield
finally:
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
raise SyncError('macos_sync_lock_timeout', '目标列表正在同步')
time.sleep(.05)
try:
stack.enter_context(sync_lock(state.root, timeout=0 if scheduled else 30))
state.check_ledger_binding()
yield
finally:
The file header states that 'No shell, model, provider SDK, or Reminders write is performed here.' However, the helper validates only that the configured python path and argv entries are absolute paths, then executes them via NSTask. That means the helper can directly trigger code that writes to Reminders or performs other side effects, contradicting the documentation's claim about what is performed here.
The helper accepts absolute paths for both the Python interpreter and argv[0] from a JSON config, then executes them via NSTask with no allowlist, signature check, path restriction, or ownership validation on the config file. If an attacker can modify that configuration or influence its creation, they can cause arbitrary local code execution under the privileges of the agent/helper, which exceeds the narrowly described synchronization role.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _run(command, timeout=30):
try:
return subprocess.run(command, capture_output=True, text=True, check=False, timeout=timeout)
except (OSError, subprocess.TimeoutExpired) as exc:
raise ScheduleError('native_command_failed', str(exc)) from exc
The helper bundle name and permission description are hard-coded in Chinese, and nearby user-facing error/advice strings in this file are also Chinese-only. Because the file does not provide user opt-in or explain that the skill is intentionally China/Chinese-locale specific, this is a natural-language locale policy violation.
The top-level docstring says this file is "Read-only local sync status" and "Never reads Reminders," which is an active behavioral claim. However, local_task_status imports and queries reminders_state.MirrorState, including binding() and mapping(), to surface reminder-mapping status and completion-origin evidence, so the documentation contradicts the implemented behavior.
The code constructs all user-facing message text in Chinese string literals. This imposes a specific language on users without any opt-in, fallback, or justification that the skill is intended only for a Chinese-speaking or region-specific audience.
This Python file includes natural-language output that is fixed to Chinese, such as '未排期', and later constructs all reminder messages in Chinese. The policy disallows forcing a specific language without user opt-in unless the locale constraint is clearly documented and justified; this file does not provide a user choice and the Chinese-only output is not clearly justified in the file itself.
The summary renderer emits Chinese-only strings like '团队任务晨间摘要' and '另有 {} 项待处理任务。' for user-facing reminders. Because the file offers no language selection or opt-in, this constitutes a locale policy issue under the natural-language policy rule.
Detected: suspicious.dynamic_code_execution