Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed lottery-analysis helper that reads user-provided draw data and saves local JSON reports without hidden network, credential, or persistence behavior.
Before installing, understand that this skill will read lottery data files you provide and may save analysis reports locally under /home/admin/worktemp. Treat the recommendations as entertainment only; the skill itself states that lottery outcomes are random and it does not guarantee winning.
The skill instructs users to run Python scripts that read input files and save analysis results to fixed paths under /home/admin/worktemp, which indicates file-write capability. Because the manifest declares no explicit tool scope or allowed-tools, the runtime may permit broader file operations than intended, reducing least-privilege guarantees and making misuse harder to constrain or audit.
The activation description is broad enough to trigger on general requests about analyzing data, generating recommendations, or ranking numbers, without clearly limiting activation to lottery-specific contexts. Over-broad activation increases the chance the skill is invoked unexpectedly, exposing file-processing and code-assisted functionality in situations where the user did not explicitly intend to use this skill.
The docstring states that format_type supports 'simple', '7+2', and '6+2' recommendation formats, implying the output shape should vary accordingly. In practice, recommend_numbers always builds up to 7 red balls and 2 blue balls regardless of format_type, so the inline documentation materially misrepresents actual behavior.
The manifest describes lottery data analysis, trend prediction, and number recommendation, but does not mention persisting results to local storage. The code not only analyzes input data but also writes a JSON report to a fixed path under /home/admin/worktemp, which is an additional behavior beyond the stated assistant scope.
No suspicious patterns detected.
