Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese countdown/anniversary helper that stores user-entered dates in one disclosed local JSON file and does not show network, credential, or hidden execution behavior.
Before installing, expect a local CLI tool that saves event names, dates, tags, and notes in ~/.qclaw/workspace/countdown.json. Avoid storing highly sensitive personal details there, and treat the external website links at the end of the documentation as publisher promotion rather than part of the countdown feature.
The skill describes functionality that reads and writes a local JSON file, but it does not declare any explicit tool scope or permissions. Undeclared file access weakens reviewability and least-privilege guarantees, making it harder for users or a host platform to understand what the skill can access or modify.
The skill name and primary description explicitly position the tool as Chinese-language only (e.g. '倒计时工具' and '中文倒数日/纪念日计算器') without indicating that users may choose another language or locale. Per the policy, a locale or language constraint should either be optional or clearly justified as region-specific.
The manifest-style description presents the skill as a local countdown/anniversary calculator, emphasizing '纯本地，无账户，无云端'. However, the document ends with branding, a homepage URL, and a promotional call-to-action link to an external site unrelated to countdown functionality. This is a semantic mismatch between the stated narrow utility and the additional promotional behavior exposed in the skill file.
A countdown/date calculator does not inherently require directing users to a vendor homepage or an AI-brand-diagnosis marketing page. Including these links introduces an unrelated promotional capability that is not necessary for recording dates or computing elapsed/remaining days.
The module docstring and CLI usage text are entirely in Chinese, and the skill name explicitly indicates a Chinese-only countdown tool. There is no natural-language indication that users can choose another language or that the locale restriction is required for a region-specific compliance or operational reason.
No suspicious patterns detected.
