Security audit

Play Rediscovery Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a low-risk self-reflection skill for helping adults rediscover play, with no code execution, credential access, persistence, or hidden data handling.

Installers should treat this as a self-reflection and hobby-discovery aid, not therapy or professional mental-health advice. Non-Chinese users may find parts of the README and examples less accessible, but the package does not show security-sensitive behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The README content is entirely in Chinese and demonstrates only Chinese-language interactions, which can steer the agent to respond in Chinese without checking the user's preferred language. This is a policy/UX safety issue because it can reduce user comprehension, informed consent, and accessibility, especially if the user expects another language and receives guidance they may misunderstand.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The 'Use when...' description includes very general conditions such as feeling life is too serious, wanting more presence, or feeling creativity has become productivity-driven. These are common life situations and the file does not define specific invocation phrases, scope constraints, or exclusion examples, which makes unintended activation more likely.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: Several usage scenarios and expected outputs are written in Chinese, while the rest of the document is in English. This can imply a locale or language preference without explicitly stating that users may choose their preferred language, which may conflict with language-neutral organizational policy expectations.

Static analysis

No suspicious patterns detected.