Security audit
Security checks for vulnerabilities and agentic risk
This media-tracking skill is mostly coherent, but it can persist family and child-specific viewing notes with broad triggers and limited privacy controls.
Install only if you are comfortable with a local ~/shows folder retaining viewing history, preferences, family-member details, and possibly child-specific reaction notes. Prefer aliases or age ranges for children, avoid recording unnecessary sensitive reactions, and review or delete the local files periodically.
The skill activates on very broad, everyday phrases like mentions of watching something or asking what to watch, without clear boundaries that confirm the user intends to use this specific tracking skill. That can cause unintended collection or modification of personal viewing history, ratings, and household-related data from ordinary conversation rather than explicit opt-in use.
The skill instructs storing persistent viewing records, ratings, notes, and family-member information in local files without disclosing that this data will be retained. Even if the data is not highly sensitive in isolation, it can reveal behavioral patterns, household composition, preferences, and routines, creating a privacy risk if stored unexpectedly or accessed by others on the same system.
The skill uses broad trigger phrases like "what should I watch?" and "recommend something," which overlap with common user requests and can cause the skill to activate in situations where the user did not explicitly intend to invoke it. This can lead to overbroad interception of conversational requests, unintended behavior precedence over other skills, and possible misuse of personal preference/history data in the wrong context.
The skill explicitly models storage of children's names, ages, and individualized viewing history, which is personal data and can become sensitive when tied to minors. Even though the file does not exfiltrate data, normalizing collection and persistence of child-related data without privacy guidance, minimization, retention limits, or consent warnings creates avoidable privacy risk if the notes are shared, synced, or accessed by others.
The skill encourages logging behavioral and emotional reaction notes about children, such as fear responses and nightmares, which can constitute sensitive profiling data. In the context of a family-tracking skill, this makes the issue more concerning because the system is not merely recommending content but persisting child-specific psychological observations without caution about confidentiality, necessity, or parental review.
No suspicious patterns detected.
