Security audit
Security checks for vulnerabilities and agentic risk
This violin coaching skill is purpose-aligned and low risk, with a disclosed but somewhat eager local progress-log feature.
Install only if you are comfortable with the agent creating a ~/violin/ folder and saving violin practice details there. Ask the agent not to save logs, or to confirm before writing, if you want session-only advice.
The skill instructs the agent to create a persistent directory in the user's home folder on first interaction without explicit user consent or a warning that filesystem changes will occur. Even though the action is low-risk in isolation, silent writes to the home directory violate least surprise and can normalize unauthorized persistence behavior.
The skill proposes logging progress to a file in the user's home directory but does not disclose retention, contents, or ask for permission before storing user practice data. Persistent storage of user-generated information without clear notice creates privacy and consent risks, even if the data seems non-sensitive.
The progress-tracking section explicitly directs persistent logging of repertoire, scales, and exercise history to ~/violin/ without any privacy notice or confirmation. In context this is less dangerous than credential theft or exfiltration, but it still introduces unannounced local data persistence that could expose personal habits or learning records to other local users or future processes.
The logging triggers are broad enough that the skill may activate on casual mentions of practice, progress, or gaps in recent logs without a narrowly scoped user request. This can cause unintended prompting or data capture behavior, which is a real security and privacy concern even though the content is focused on violin practice rather than a sensitive domain.
No suspicious patterns detected.
