Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local personal-knowledge helper with no evidence of hidden access, exfiltration, command execution, or persistence, though its draft-capture wording may overstate what it saves.
Install only if you want an in-memory helper for organizing or searching supplied notes/sample knowledge. Do not rely on the ingest action as durable storage unless the surrounding environment separately saves the returned draft.
L03 says to use the skill whenever the user wants to capture notes, summarize learning material, or explore relationships between concepts, which are wide-ranging activities common in everyday assistant interactions. The description does not provide exclusion conditions or negative examples to clarify the trigger boundary.
Phrases such as “复习” and “第二大脑” are broad and can appear in ordinary conversation without necessarily indicating a request to use this specific skill. The file lists example triggers but does not define scope limits or non-trigger examples to reduce accidental matches.
The ingest branch tells the caller that a knowledge item was 'captured as a draft', but the code only derives metadata and returns it in the response. Nothing is written to storage or appended to the provided knowledge base, so users or downstream agents may falsely rely on data having been saved. In a personal knowledge skill, this can cause silent data loss and workflow integrity problems.
The response message explicitly claims 'Knowledge item captured as a draft' even though no storage action occurs anywhere in the handler. This is a trust and integrity issue: users may discard original notes or assume later retrieval is possible, resulting in accidental loss of personal knowledge. The skill context makes this more concerning because reliable capture is a core promise of a knowledge hub.
The intent configuration is dominated by Chinese trigger terms, and the runnable examples are all Chinese-language commands except embedded English tokens. This can amount to a locale/language bias because the skill appears designed around Chinese interaction without documenting user choice or explicitly offering multilingual opt-in behavior.
The skill description is very broad and lacks clear activation boundaries, so an orchestrating agent could invoke it for loosely related requests involving notes, search, or knowledge organization. Overly broad routing increases the chance of inappropriate activation, which can expose personal knowledge data or cause unintended processing of sensitive user content.
This code file includes natural-language test inputs exclusively in Chinese (for example, search, ingest, and explore requests), which suggests the skill behavior may be constrained to a specific language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and there is no visible indication here that other languages are supported or that Chinese is optional.
No suspicious patterns detected.
