Security audit
Security checks for vulnerabilities and agentic risk
This is a document-only gift-planning skill with clear privacy and no-shopping boundaries and no executable behavior.
Safe to install for ordinary gift planning. Users should still avoid entering full addresses, account details, exact private dates, medical or financial information, and should treat any budget field as a comfort range rather than financial advice.
The acceptance test explicitly requires English-only output, which creates an unjustified language restriction unrelated to the skill's privacy-light gift-planning purpose. While not a classic security exploit, this can cause exclusionary behavior, override user language preference, and encourage downstream prompt logic that rejects or mishandles non-English inputs.
The manifest sets "language": "en", which is a natural-language locale constraint. There is no nearby indication that users can opt into another language or that the English-only setting is required for a documented region-specific purpose.
