Security audit
Security checks for vulnerabilities and agentic risk
This training assistant is coherent in purpose, but it under-discloses persistent local file writes and outbound WeChat-style reminder behavior.
Review before installing. Use it only if you are comfortable with a training skill that may create persistent files in your home directory and may use networked reminder channels. Require explicit confirmation before writing training records or sending reminders, especially where employee progress, assessments, or personal data are involved.
The skill manifest declares only file-read permission, but the documented initialization workflow creates directories and writes multiple files under ~/.workbuddy/tasks. This is a real capability mismatch that can mislead users and security controls, enabling unauthorized persistence and local state modification beyond the declared permission model.
The skill is described as a training and knowledge-management assistant, but its behavior includes local workspace creation, archival, and persistent task logging that are not reflected in the manifest description. This creates deceptive functionality scope, making operators less likely to anticipate storage of potentially sensitive training, personnel, or assessment data.
The when_to_use field includes broad, common trigger phrases such as 培训, 出题, and 知识管理, which can cause accidental invocation during ordinary conversation. Overbroad activation increases the chance the skill runs in unintended contexts, potentially accessing files or sending networked reminders based on unrelated user content.
The trigger section provides a wide keyword list without activation boundaries, exclusions, or examples of when not to invoke the skill. In a skill with file-read and network-access permissions, ambiguous activation increases the risk of unintended processing of user data and unwanted outbound actions.
This duplicate finding points to the same persistent workspace creation behavior: making ~/.workbuddy/tasks and writing multiple logs that survive the current session. Persistent artifacts can be later accessed, correlated, or misused, and the risk is elevated here because the skill handles training and assessment workflows that may include employee-related data.
TASK_NAME="training-$(date +%Y%m%d)"
mkdir -p ~/.workbuddy/tasks/"$TASK_NAME"
cat > ~/.workbuddy/tasks/"$TASK_NAME"/task-plan.md << 'EOF'
# 任务计划 - 培训赋能
This duplicate finding points to the same persistent workspace creation behavior: making ~/.workbuddy/tasks and writing multiple logs that survive the current session. Persistent artifacts can be later accessed, correlated, or misused, and the risk is elevated here because the skill handles training and assessment workflows that may include employee-related data.
TASK_NAME="training-$(date +%Y%m%d)"
mkdir -p ~/.workbuddy/tasks/"$TASK_NAME"
cat > ~/.workbuddy/tasks/"$TASK_NAME"/task-plan.md << 'EOF'
# 任务计划 - 培训赋能
The skill advertises proactive WeChat push reminders but does not warn users about outbound messaging, recipient handling, or what data may be transmitted. Because reminders are tied to learning progress and assessments, this can expose personal or performance-related information through external channels without adequate transparency or consent.
The primary description is presented entirely in Chinese and the rest of the skill instructions are effectively Chinese-only, but there is no statement that the skill is region-specific or that users may choose another language. This can be a natural-language policy issue when a skill implicitly forces a locale without opt-in.
No suspicious patterns detected.