Security audit

intimate-ch03-attraction

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only Chinese study helper for a textbook chapter and does not request system access, credentials, code execution, network access, or persistence.

This appears safe to install for studying the chapter, especially if you want responses in Chinese with English terms introduced. Treat it as educational material rather than relationship, psychological, medical, or legal advice, and avoid sharing sensitive personal details unless necessary.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The skill hard-codes '中文回答，术语首次给英文' without checking the user's language preference. This can override user choice or broader system defaults, reducing usability and potentially causing misunderstanding if the user expected another language. In a learning skill, forced language selection is a policy/compliance issue rather than a direct security exploit, so the danger is limited.

Static analysis

No suspicious patterns detected.