Security audit
Security checks for vulnerabilities and agentic risk
This is a self-reflection skill with clear boundaries and no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Installers should treat this as a reflective personal-development aid, not therapy or medical, legal, or crisis support. Users who are grieving, in acute distress, or dealing with serious health or legal decisions should involve qualified human support. The package would also benefit from clearer language-preference documentation because examples are mixed English and Chinese.
The markdown includes a Chinese-language usage scenario and expected output, while the rest of the skill is written in English. This introduces an implicit language shift without stating that the skill is multilingual or that users can choose their preferred language, which can violate language/locale policy expectations.
The README explicitly frames emotionally sensitive topics such as mortality, eulogies, health scares, and end-of-life legacy reflection, but provides no caution about emotional distress, crisis escalation, or limits of the skill. In a reflective wellness-style skill, that omission can lead vulnerable users to rely on the agent in moments of acute distress without being redirected to appropriate human or professional support.
The README presents some scenarios entirely in Chinese and others in English, but it does not explain whether the skill follows the user's language preference or defaults to a particular language. This can create an implicit language/locale policy ambiguity that may result in responses being forced into an unintended language without explicit user opt-in.
The manifest sets "language": "en", which indicates a fixed language preference. Under the policy guidance, a skill should not force a specific language unless it offers opt-in choice or clearly documents why the locale restriction is necessary.
No suspicious patterns detected.
