Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent app-generation purpose, but its cloud templates can expose private personal records through unauthenticated public APIs and vulnerable generated pages.
Use local-only mode for sensitive personal data unless you review the generated code. Do not deploy the cloud mode as-is; add authentication, owner-level authorization, restricted CORS, input validation, safe DOM rendering instead of innerHTML string templates, and pinned deployment tooling first.
assets/template-api.js:4<![CDATA[Unauthenticated Public Read, Write, and Delete Access to Personal Data]]>
assets/template-app.js:115<![CDATA[Stored Cross-Site Scripting Through Unescaped Record IDs]]>
assets/template-app.js:257<![CDATA[Stored Cross-Site Scripting in Smart Select Manager Attributes]]>
references/deploy-guide.md:9<![CDATA[Unpinned Third-Party CLI Installation and Execution]]>
The declared purpose frames the skill as an app-generation assistant, but the content also instructs the agent to generate backend APIs, database access patterns, SQL/D1 integration, and CORS-enabled serverless components. This mismatch can mislead reviewers and users about the true operational scope, causing unsafe trust decisions and allowing higher-risk code generation behaviors to bypass expected scrutiny.
Referenced artifact was not completely inspected
| `template-app-local.js` | 学习本地 localStorage CRUD、Smart Select、导入导出 |
Referenced artifact was not completely inspected
| `template-app.js` | 学习云模式 API CRUD、离线 fallback |
Referenced artifact was not completely inspected
| `template-app.js` | 学习云模式 API CRUD、离线 fallback |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
顶部一张统计卡：大数字（总量）+ 分状态统计 + 一条彩色比例条。让用户一眼看清全局。适用场景：任何有“状态分布”的管理类 App（在用/备用/已停、架上/冰箱/喝完等）。已在补剂管家实战验证。
<div id="overview" class="overview"></div> <!-- JS 填充 -->
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<svg width="17" height="17" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="7"/><line x1="16.5" y1="16.5" x2="21" y2="21"/></svg>
</button>
<!-- 搜索框默认 hidden，带✕关闭按钮 -->
<div class="search-wrapper hidden" id="searchWrap">
<span class="search-icon">🔍</span>
<input type="search" id="search-input" placeholder="搜索..." oninput="handleSearch(this.value)">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<svg width="17" height="17" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="7"/><line x1="16.5" y1="16.5" x2="21" y2="21"/></svg>
</button>
<!-- 搜索框默认 hidden,带✕关闭按钮 -->
<div class="search-wrapper hidden" id="searchWrap">
<span class="search-icon">🔍</span>
<input type="search" id="search-input" placeholder="搜索..." oninput="handleSearch(this.value)">
The skill description instructs the user entirely in Chinese and explicitly tells the user to communicate their request in that language context, without offering an alternative language or opt-in. This creates a locale/language restriction in the skill's natural-language interface with no documented choice or justification.
The README promotes cloud deployment, multi-device sync, and real-time data synchronization, but does not warn users that their data may be transmitted to third-party platforms such as Cloudflare, Vercel, or Netlify. Because the skill is aimed at managing personal data categories like health supplements, habits, and collections, users may unknowingly expose sensitive information to external services.
The README instructs users to 'tell it what you want to manage' after feeding SKILL.md to any AI, but it does not define specific trigger phrases, boundaries, or exclusion conditions. This is broad natural-language activation guidance that overlaps with ordinary conversation and may cause the skill to be invoked in unintended contexts.
The skill describes capabilities that involve networked/cloud deployment and backend/API generation, but it does not declare any explicit tool scope or allowed-tools boundary. That creates a governance gap: an agent may infer it is permitted to use network-capable tools or generate/deploy cloud-connected components without clear authorization, increasing the risk of unintended external access or over-broad actions.
The manifest description and core instructions are written to direct the skill experience in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking region. This creates a language/locale policy concern because it imposes a specific language without user opt-in.
This manifest presents the skill description, inputs, outputs, and trigger examples in Chinese, while not indicating that the user can choose another language or locale. That creates a natural-language policy concern because the skill appears to force a specific language without explicit user opt-in.
This code exposes a deletion endpoint that removes records from the database, but there is no confirmation prompt, user-facing log/message, or inline warning comment describing the destructive behavior. For a code file, destructive or irreversible operations should include some form of disclosure unless clearly documented as part of the skill's stated purpose.
The HTML sets lang="zh-CN" and the visible interface labels and placeholders are in Chinese throughout the template. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
The manifest says the skill tells the AI what to manage and gets a dedicated app generated, which suggests app scaffolding/generation as the main purpose. This file instead contains runtime application behavior for fetching, creating, updating, and deleting records via /api/TABLE and localStorage, which is materially broader than simple app generation.
This markdown file documents Smart Select management behavior, including deleting a historical value and clearing that field from all records using it. Although it mentions confirmation for the delete action, the skill description does not clearly warn users that this can bulk-modify existing data and may be hard to undo.
The DELETE endpoint permanently removes records with no user warning, confirmation flow, soft-delete mechanism, or recovery guidance. In an agent-generated app context, this increases the chance of accidental or scripted destructive actions causing irreversible data loss, especially because the API is simple and unauthenticated in the example.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The guide tells users the agent will 'automatically help deploy' to Cloudflare after account setup, but it does not clearly disclose that deployment uploads application code, configuration, and possibly user-provided content to a third-party cloud provider. In a skill that generates and deploys apps, lack of transparency about data transfer and external service interaction can mislead users into sharing assets or sensitive configuration without informed consent.
No suspicious patterns detected.