Security audit
Security checks for vulnerabilities and agentic risk
This productivity skill turns goals into step-by-step plans and shows no evidence of hidden access, persistence, network use, or data exfiltration.
This skill appears safe to install for personal planning use. Be aware that it may activate for a wide range of planning or procrastination-related requests, and it does not explicitly document tool permissions even though the artifact does not use external tools.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
def _load_prompt_template(skill_name):
return PROMPT_TEMPLATE
def _clean_text(value: Any) -> str:
Without declared permissions the skill's intent is opaque and cannot be validated.
This markdown file contains substantial instructional content in both English and Chinese, including a full scenario that assumes Chinese-language interaction. Under the policy rule, forcing or assuming a specific language without explicit user opt-in can be a natural-language policy concern, and no language-selection guidance or justification is provided here.
The description says to use the skill when the user "cannot see the first move," is "stalling mid-project," or needs a task map for study, home, admin, or personal projects. These conditions are quite broad and could match many ordinary productivity conversations without clearly defining boundaries for when this skill should or should not activate.
The file introduces a Chinese name and later includes a full Chinese usage scenario, but it does not explain whether output language follows user preference or whether multilingual behavior is optional. This can create ambiguity around language handling and may conflict with policies requiring user language choice rather than implicit switching.
The usage criteria include generic situations such as wanting to break a goal into a sequence or start today instead of circling the task. While understandable, the file does not provide explicit non-trigger cases or tighter scope limits, which increases the chance of unintended invocation for routine planning requests.
No suspicious patterns detected.