Security audit
Security checks for vulnerabilities and agentic risk
This is a local date/time utility skill, and the reviewed artifacts do not show hidden access, persistence, network activity, or destructive behavior.
Installers should treat this as a simple local utility. The main caveat is accuracy: review the toISOString behavior before relying on it for timezone-sensitive logs, audit records, or API timestamps, because it does not emit a standard UTC ISO string.
The description says to use the skill whenever you need to 'format, parse, compare, or manipulate dates and times,' which is a very broad condition that could overlap with many ordinary requests involving dates. The file does not provide explicit trigger phrases, boundaries, or negative examples clarifying when this skill should or should not activate.
The comment says "Convert to ISO string (local time)", which implies behavior comparable to standard ISO serialization. However, the function just formats the date as 'YYYY-MM-DDTHH:mm:ss.SSS' without timezone designator or UTC conversion, so it does not produce a true ISO string like Date.prototype.toISOString(). This is an active documentation/intent mismatch that could mislead callers about timestamp semantics.
The description says the package 'Provides date and time manipulation operations for working with dates,' which is a very general capability statement without any explicit trigger phrases, scope limits, or exclusion conditions. In a manifest file, this kind of broad wording can make it unclear when the skill should activate versus when other general-purpose skills should handle the request.
No suspicious patterns detected.
