Security audit
Security checks for vulnerabilities and agentic risk
This is a small UUID utility with disclosed, purpose-aligned behavior and no evidence of hidden network, persistence, credential, or destructive activity.
Installers should prefer UUID v4 for general identifiers. Use UUID v1 only when its timestamp and host-identifying metadata are acceptable for the place the UUID will be stored or shared.
The documentation promotes UUID v1 generation but does not warn that v1 embeds timestamp information and typically node/MAC-derived host identifiers. In a utility skill whose purpose is generating identifiers, users may unknowingly expose device or environment metadata if they use v1 in logs, URLs, or shared records, creating a real privacy and correlation risk.
The manifest sets language: en, which imposes a specific language selection, yet the file itself includes a Chinese section later in the document. This creates a natural-language policy concern because the skill appears to force one locale rather than explicitly offering user choice or documenting a justified locale restriction.
