Security audit

Daily Reminder

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local Chinese-language reminder list skill that stores user-entered reminders, countdowns, and anniversaries in local JSON files, with some overstated reminder/countdown claims but no evidence of malicious behavior.

Install only if you want a Chinese-language local reminder-note list, not a real notification or countdown engine. Avoid storing sensitive personal details unless you are comfortable with them being kept in plaintext JSON files in the skill directory, and be aware that there is no built-in delete or export command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 该技能的整体主题与声明基本相关，确实围绕提醒、倒计时、纪念日进行管理；但存在重要描述不符。首先，代码使用 fs 在技能目录下创建并读写 reminders.json、countdowns.json、anniversaries.json，属于实际的数据存储能力，而声明权限为空。其次，名称和描述暗示这是“每日提醒、倒计时”工具，但代码没有调度、通知、时间比较、到期计算等逻辑，所谓 reminder/countdown/anniversary 都只是把用户输入保存下来并列出，parseDate 甚至未被实际使用。因此其主要功能更准确地说是“文本记录/列表管理”，不是完整的提醒或倒计时工具。综合判断为存在描述与行为不匹配。

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: 整个技能描述、标签、触发词和示例均仅以中文给出，未说明这是面向特定中文用户群体的区域性技能，也没有提供语言/locale 选择。根据语言/locale 策略，这可能构成未获用户选择即强制特定语言的自然语言策略问题。

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger keywords are broad everyday terms such as '提醒' and '纪念日', which can cause the skill to activate on unrelated conversation. In a skill that stores user-provided dates and reminders, accidental activation can lead to unintended data capture, confusion, or unauthorized modification of reminder records.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill persistently stores reminder, countdown, and anniversary content to local JSON files without notifying users or offering consent/control. Because this data may contain sensitive personal schedules or relationship information, silent retention increases privacy risk, especially in shared deployments, multi-user environments, or systems with broad filesystem access.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest description promises reminder, countdown, and anniversary management semantics, but the code only appends user input to local JSON files and lists it back later. There is no timer, notification delivery, countdown calculation, anniversary date handling, or use of the date parser to perform the claimed reminder functionality.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The description, activation keywords, and parsing logic are all written specifically for Chinese terms such as '提醒', '倒计时', and '纪念日', with no indication that other languages are supported or that the user can opt in to a Chinese-only mode. This creates a natural-language locale constraint that is not documented as optional or region-specific.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The inline comment implies semantic parsing of reminder configuration, but the branch merely detects whether the message contains '提醒' and forwards the raw message to setReminder. Since no extraction of time, schedule, or structured reminder fields occurs, the comment overstates and contradicts the actual behavior.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The package description is written entirely in Chinese, which can indicate the skill is intended or presented only in a specific language without any opt-in or documented locale constraint. The policy requires offering language or locale choice, or clearly justifying a region-specific constraint.

Static analysis

No suspicious patterns detected.