Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese almanac/date-selection skill with no network use, external dependencies, file mutation, or persistence, though its documentation has script-name inconsistencies.
Installers should expect a Chinese-language astrology/almanac CLI. Treat any 八字 input as personal information, but the inspected code only uses it locally for scoring. Use scripts/almanac.js despite the stale README/SKILL examples that mention other script names.
The entire skill description is presented only in Chinese, including setup and usage instructions, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the policy for natural-language constraints, forcing a specific language without opt-in is a locale/language policy concern.
The trigger list includes broad, common phrases such as '黄历', '择日', and '选日子' that may cause the skill to activate in loosely related conversations where the user did not intend to invoke this specific capability. Unintended invocation can misroute user requests, create confusing or unwanted astrological guidance, and increase the chance that sensitive personal data such as birth dates or 八字 is elicited unnecessarily.
This code file contains user-facing natural-language strings that force a specific language/locale. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, which is not present here.
The script's primary interactive output is presented only in Chinese, which constitutes a language/locale policy concern under the natural-language policy rule. There is no indication that the user can choose another language or that the locale limitation is explicitly justified.
The natural-language interface, examples, activity types, and trigger phrases are presented entirely in Chinese, which effectively imposes a language constraint. The file does not state that Chinese is optional, offer an alternative language, or justify the restriction as a region-specific requirement.
The natural-language description is written entirely in Chinese, and the manifest provides no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the locale/language policy, forcing a specific language without user opt-in can be a policy concern.
SQP-3 applies to all file types and covers language or locale policy violations. This reference file presents all content in a single forced language, with no opt-in, alternative locale, or explanation that the skill is intentionally limited to Chinese users or a China-specific compliance/domain context.
