Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent local idea-memory helper, but it can trigger broadly and automatically persist personal or business ideas without explicit per-save consent.
Review before installing if you discuss sensitive ideas, business plans, client work, or inventions. The skill is local and purpose-aligned, but you should only use it where automatic persistent idea capture is acceptable, and you should periodically inspect or clear knowledge/personal/ideas.md.
The skill description says it should activate when a user mentions very generic terms like "idea," "thought," "concept," "brainstorm," "project idea," or "what if." These phrases are common in ordinary conversation, so the skill may trigger outside the user’s intent and unexpectedly store or process personal content in the ideas knowledge file.
The activation description includes broad everyday phrases like idea, thought, concept, startup, project idea, and what if, which can cause the skill to trigger in many normal conversations outside the user's clear intent. In a personal-memory skill, over-triggering is more dangerous because it can lead to unnecessary reading of private notes and unprompted persistence of sensitive brainstorms.
The skill title and operating instructions are written in Russian and specify tone and behavior in Russian without indicating that language choice is optional. This can violate language/locale policy when the user has not opted into Russian or been offered an alternative.
The skill instructs the agent to automatically store any new idea in knowledge/personal/ideas.md, but it does not require clear notice or consent about persistent retention. Because ideas may contain sensitive personal, business, or intellectual-property information, silent storage increases privacy risk and can capture data the user did not expect to be retained.
No suspicious patterns detected.
