Security audit
Security checks for vulnerabilities and agentic risk
This skill is a reflective generosity-planning helper with disclosed limits and no evidence of hidden access, persistence, data collection, or unsafe execution.
Installers should understand this as a personal reflection tool, not financial, legal, mental-health, or tax advice. Avoid sharing unnecessary sensitive financial or family details, and consult qualified professionals for major giving structures, hardship, legal obligations, or mental-health distress.
The activation guidance is broad enough to catch common self-help, guilt, relationship, and values-alignment queries, which can cause the skill to engage outside a narrowly defined generosity-planning context. This is not directly malicious, but it increases the chance of overreach into emotionally sensitive or adjacent financial/mental-health discussions without clear routing boundaries.
The skill description presents example scenarios in both Chinese and English, but it does not explain whether the skill adapts to the user's language preference or whether a specific language will be used by default. This can create a language/locale policy concern because users are not explicitly offered a choice despite multilingual behavior being implied.
A localized example is presented in Chinese, but the document does not clarify whether the skill adapts language to the user's input or whether Chinese responses are limited to Chinese-speaking users. This can create ambiguity around language behavior and may imply a locale-specific response mode without explicit opt-in guidance.
The manifest explicitly sets the skill language to "en", which is a natural-language locale constraint. Under the policy, locale restrictions should either offer user choice or be clearly justified; this file provides neither.
No suspicious patterns detected.
