Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Thailand travel and relocation guide with scoped local memory, and I found no deceptive, destructive, or exfiltration behavior.
Before installing, understand that the skill may keep a local ~/thailand/memory.md file with travel or relocation preferences and constraints. That can be useful for personalization, but review or delete it if it contains sensitive visa, health, family, work, or budget details you do not want persisted.
The title explicitly constrains the skill content to Thailand, which is a locale-specific restriction. In this file, that regional limitation is not presented as an optional user choice or justified as a clearly region-specific compliance/travel tool, so it can violate the policy against forcing a locale without opt-in.
The skill explicitly creates and updates a local memory file to store user context, but it does not clearly disclose to the user that conversation details may be persisted on disk and later reused. This creates a privacy risk because travel, relocation, visa, health, family, and work-related constraints can be sensitive, and users may reasonably assume the conversation is ephemeral unless told otherwise.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/thailand
touch ~/thailand/memory.md
chmod 700 ~/thailand
chmod 600 ~/thailand/memory.md
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/thailand touch ~/thailand/memory.md chmod 700 ~/thailand chmod 600 ~/thailand/memory.md
If `~/thailand/memory.md` is empty, initialize it from `memory-template.md`.
The instruction to read stored memory silently means prior user data is reused without fresh visibility or awareness at the time of access. This weakens informed consent and can surprise users, especially when the stored data may include sensitive personal preferences or constraints related to relocation, health, family, visa status, or finances.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Core Principle
Visa planning should be treated as a dynamic system. Do not finalize flights, schools, or long leases without checking official portals for the user nationality and travel date.
## Major Pathways (check latest rules)
The file presents all user-facing guidance in English and does not indicate that users may choose another language or that English is required for a justified regional or compliance reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.