Security audit
Security checks for vulnerabilities and agentic risk
This is a prompt-only pantry and grocery planning skill with no code, network, credentials, persistence, or hidden behavior.
Before installing, be aware that the skill appears limited to English and may activate for general grocery-list organization requests, but it does not run code or access accounts, credentials, files, or the network.
The file explicitly requires the skill to be "Written in English only," which is a natural-language locale restriction. Because there is no indication that users may choose another language and no documented regional or compliance justification, this appears to violate the language/locale policy constraint.
This markdown file is in scope for vague-trigger review. The sample input includes the generic phrase "Help me reset my staples," which overlaps with common conversational wording and does not clearly distinguish a precise activation phrase from a general example request, increasing the chance of unintended invocation if reused as trigger guidance.
The manifest sets language: "en", which indicates a fixed language choice. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.
The manifest's trigger list includes phrases like "plan pantry basics" and "group this grocery list by aisle," which are relatively generic requests that could overlap with ordinary conversation or broader shopping-assistant tasks. The file does not provide exclusion conditions or tighter context constraints to clarify when this skill should activate versus similar grocery-related skills.
The language field is set to en, which expresses a locale/language restriction in the skill metadata. There is no nearby indication that users can opt into other languages or that the English-only scope is required for a justified region-specific purpose.
