Security audit
Security checks for vulnerabilities and agentic risk
This forecasting skill is coherent and disclosed: it stores local prediction notes for its stated purpose and does not show hidden execution, credential use, or exfiltration.
Before installing, understand that the skill is designed to keep forecasting notes under ~/prediction/ across sessions. Avoid storing sensitive personal, medical, legal, financial credential, or unreleased company details there, and choose explicit-only activation if you do not want forecasting behavior to appear proactively.
The invocation guidance says to use the skill whenever a user needs a forecast and lists very broad domains including business, technical, policy, sports, market, and personal planning. It does not provide explicit trigger phrases, exclusions, or negative examples, which makes activation scope ambiguous for a markdown skill description.
The activation guidance is broad enough to trigger on generic questions like 'what is likely' or 'what will happen,' which can cause the skill to activate unexpectedly and influence interactions outside the user's clear intent. In a forecasting skill, this creates integrity and consent risks by routing conversations into persistent forecasting workflows without sufficiently explicit user opt-in.
The setup directs the agent to create local files and persist user forecasting data, but it does not require a clear user-facing disclosure or consent step before storage begins. This is dangerous because users may unknowingly have preferences, assumptions, open forecasts, and shorthand examples retained across sessions, creating privacy and data retention risks.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
touch ~/prediction/scorecard.md touch ~/prediction/reference-classes.md touch ~/prediction/assumptions.md chmod 700 ~/prediction ~/prediction/archive chmod 600 ~/prediction/memory.md ~/prediction/forecast-log.md ~/prediction/scorecard.md ~/prediction/reference-classes.md ~/prediction/assumptions.md
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
touch ~/prediction/reference-classes.md touch ~/prediction/assumptions.md chmod 700 ~/prediction ~/prediction/archive chmod 600 ~/prediction/memory.md ~/prediction/forecast-log.md ~/prediction/scorecard.md ~/prediction/reference-classes.md ~/prediction/assumptions.md
If the files are empty, initialize them from `memory-template.md`.
The template directs creation of persistent memory files under ~/prediction/, which can cause user forecasting data, preferences, and potentially sensitive notes to be stored on disk without any explicit notice, consent flow, retention limits, or storage safeguards. In this skill, the stored fields include durable lessons, blind spots, assumptions, and forecast logs, so even if the intent is organizational, it creates a privacy and data persistence risk if users do not expect long-term local storage.
No suspicious patterns detected.