Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Persian-language research and experiment journaling skill with disclosed web research and file-update behavior.
Install this if you want a Persian-first, persistent personal research lab. Review where it will store or update your log/model files, and use the manual copy/install path or pin the installer source if you want tighter supply-chain control.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
### سوال امروز
### شواهد چه می‌گویند
### آنچه هنوز نامشخص است
### فرضیه
### آزمایش امروز
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
### سوال امروز
### شواهد چه می‌گویند
### آنچه هنوز نامشخص است
### فرضیه
### آزمایش امروز
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
### سوال امروز
### شواهد چه می‌گویند
### آنچه هنوز نامشخص است
### فرضیه
### آزمایش امروز
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
### سوال امروز
### شواهد چه می‌گویند
### آنچه هنوز نامشخص است
### فرضیه
### آزمایش امروز
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: persian-success-lab
description: Run the user's personal "Success Lab" — a long-running, evidence-based research-and-experiment system investigating what actually causes success and what improves the user's own outcomes. Use this skill whenever the user invokes commands like `today`, `question [topic]`, `experiment [hypothesis]`, `review`, `dashboard`, or `audit` in this context, or asks to run their daily research session, log an experiment, review their research log, see their success-lab dashboard, or challenge their current model of success. Also trigger when the user says things like "run my lab", "امر�
The README states that the skill enforces mandatory Persian-language output, which is a natural-language locale restriction. Under the policy, forcing a specific language without user opt-in is a violation unless the constraint is explicitly optional or justified as a region-specific tool.
These lines explicitly require all user-facing content to be in Persian and do not provide any user choice or opt-in mechanism. This matches the policy's prohibited pattern of forcing a specific language or locale.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The trigger conditions are broad enough to activate on loose references to a research log, dashboard, experiments, or a 'model of success,' which can cause unintended skill invocation and instruction capture. In an agent setting, overbroad routing is dangerous because it lets specialized instructions override normal assistant behavior in contexts the user may not have clearly intended.
Forcing Persian-only output from metadata-level activation without user opt-in can override the user's actual language preference and reduce transparency about what the agent is doing. This becomes a safety issue when important caveats, consent prompts, or state/persistence disclosures are delivered in a language the current user did not request or may not fully understand.
The 'non-negotiable' requirement that all user-facing content be in Persian removes the agent's ability to adapt safety-critical messaging to the user's needs. Hard language constraints can interfere with informed consent, accurate warnings, and accessibility, especially if the skill is triggered accidentally or used by someone other than the intended user.
The expected output explicitly requires a compact Persian response, which imposes a specific language choice. In this eval file there is no indication that the user can opt into another language or that the Persian-only requirement is justified by a region-specific purpose.
The file instructs that every value filled into the schema must be written in Persian, which imposes a specific language requirement. This is a natural-language policy concern because the file does not offer the user a language choice or describe this as an optional or region-specific constraint.
The file hard-requires Persian output for source-transparency and missing-evidence statements, which can override the user's preferred language and reduce informed consent and comprehension. In a research-oriented skill, forced language output can cause users to miss limitations, uncertainty, or safety-relevant caveats if they are not comfortable reading Persian.
The file explicitly requires Persian-only output for dashboard presentation, which overrides normal user choice of language and can reduce informed consent or usability for users who expect another language. While this is not a classic security flaw, it is a genuine policy/interaction vulnerability because it can constrain communication in ways the user did not request and may cause confusion or misinterpretation in a research-oriented workflow.