Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a disclosed local parenting-guidance helper, with health-adjacent advice and Chinese-language output that users should understand before relying on it.
Install only if you are comfortable with Chinese-first parenting guidance and understand that milestone results are informational, not medical diagnosis. Consult a pediatrician or developmental specialist for real concerns. I also observed syntax errors in several Python files, so the package may need fixes before it runs correctly, but that is a functionality issue rather than a security concern.
The activity names, materials, steps, safety notes, and age-range output text are written exclusively in Chinese, and the file does not indicate that Chinese output is optional or that the skill is intentionally limited to a Chinese-speaking locale. This can violate language/locale policy when users are not given a choice or opt-in for a specific language.
This code embeds all user-facing descriptions, examples, and guidance in Chinese string literals. Because the skill does not provide any user opt-in, language selection, or documented region-specific justification, it appears to force a specific language/locale, which matches the language-policy violation criteria.
This file embeds all user-facing scenario descriptions, steps, and example scripts in Chinese, which effectively forces a specific language for the skill's outputs. The policy requires flagging language or locale constraints when the skill does not offer opt-in or document a justified region-specific limitation.
The file forces Chinese labels, descriptions, warnings, and recommendations throughout, with no mechanism for user language selection or any documented justification that the skill is intended only for a Chinese-language audience. This can violate language/locale policy because the skill imposes a specific language without opt-in.
The code generates developmental assessments, red-flag warnings, and recommendations to seek professional evaluation, but it does not present any user-facing disclaimer that the output is informational rather than medical advice. In a child-development context, users may over-trust these outputs and delay appropriate care or become falsely reassured, especially because the logic is simplistic and based on hardcoded milestones and exact age thresholds.
The natural-language type constraint on the child profile limits gender to "male" or "female" with no user choice or documented justification. This can violate organizational language/policy expectations around inclusive handling of user identity data.
The file includes multiple user-facing docstrings, guidance strings, tips, and summaries in Chinese, while other surrounding text is in English. This imposes a specific language on users without any opt-in, fallback, or documented justification that the skill is intended only for Chinese-speaking users.
The package description includes a Chinese-language product framing alongside the English name, which may indicate the skill is intended to operate in a specific language/locale without documenting user choice. Under the policy rule, locale or language constraints should be explicit and opt-in unless clearly justified as region-specific.
The docstring on the main handler says "Main handler function for OpenClaw skill," which contradicts the rest of the file's clearly parenting-focused functionality such as milestone assessment, activity recommendations, communication guidance, and behavior analysis. This is an intent/documentation mismatch rather than a mere omission because the label describes a different skill identity than the code actually provides.
The test invokes behavior analysis with Chinese text literals, while the rest of the file and test labels are in English. This suggests the skill may assume or exercise a specific language context without documenting user opt-in or a justified locale-specific scope, which can conflict with language/locale policy expectations.
The description explicitly presents the skill as "Parenting Growth Partner / 育儿成长伙伴," which suggests a fixed bilingual language presentation rather than offering the user a language or locale choice. Under the language/locale policy, natural-language content should not impose a specific language format without opt-in unless clearly justified.
No suspicious patterns detected.
