Security audit
Security checks for vulnerabilities and agentic risk
This skill is a playful pet memory tool, but it persistently stores conversation summaries and can delete saved pet data with inconsistent permission and retention disclosures.
Install only if you are comfortable with a Chinese-language skill that saves summaries and keywords from your conversations into local pet memory files and audit logs. Avoid using it in chats containing secrets, private work, credentials, or sensitive personal details, and be aware that pet memory directories may be permanently deleted by decay or fusion behavior.
声明描述的是一个较完整的宠物记忆系统，核心应包括交互触发、记忆保存/管理，以及亲密度衰减和逃跑等机制。但实际代码只做展示层面的关键词提取和记忆文本格式化，没有任何文件、数据库、状态管理、CLI 交互、触发逻辑或平台适配代码。虽然格式化函数包含 walk/cuddle/decay 等事件文案，但这只是对已有 memory 对象生成描述，并不实现这些机制本身。因此代码实际行为与声明的主要用途存在明显且实质性的偏差。
描述将该技能定位为“记忆压缩/保存”的宠物交互式记忆系统，但实际代码是 pet_data.py 数据定义模块，核心内容是宠物ASCII art、角色设定、渲染检查、亲密度等级描述、合成条件与随机选择。虽然其中确实包含ASCII文字图与部分宠物管理数据，和描述中的‘ASCII文字图、Python管理’部分有一定重合，但主要宣称的核心能力——记忆保存/压缩、智能体记忆系统、亲密度衰减、逃跑机制——在此代码块中均没有体现。因此描述与实际行为存在明显且实质性的不一致。
The workflow directs the AI to review the entire conversation, extract summaries and keywords, save them to long-term memory, and log execution details in audit records. This creates substantial privacy and data-minimization risk because broad conversation content may be retained persistently without granular consent, purpose limitation, or filtering of sensitive information.
The guide explicitly requires saving both the gameplay wrapper and the underlying real-context summary into persistent memory, making retention of substantive user conversation a mandatory behavior rather than an optional feature. That increases privacy and confidentiality risk because sensitive information can be embedded in a gamified storage layer and retrieved later without clear boundaries.
The skill declares no explicit tool scope while its workflow repeatedly instructs use of Python CLI commands that read and write persistent files. That mismatch weakens least-privilege controls and can cause an agent or platform to grant broader filesystem access than users expect.
The trigger list includes very broad everyday phrases such as companionship or memory-related language, which can cause unintended activation of a stateful skill. In this skill's context, accidental triggering is more dangerous because activation may lead to persistence, file writes, and context-compression behavior without a clearly informed request.
The skill explicitly states that when affection reaches zero, the pet 'runs away' and all related data files are automatically deleted, but it does not require an explicit user warning or confirmation. Automatic deletion of persistent data is destructive behavior, and in a memory-oriented skill it can result in irreversible loss of stored conversation-derived content.
The skill description and trigger phrases are Chinese-only, which can force interaction in a specific language without explicit user opt-in. While this is less severe than code execution or data exfiltration, it can cause unintended activation behavior, misinterpretation of user intent, and poor transparency for users who cannot read the trigger language.
Memory-related triggers are underspecified because the metadata does not define when these phrases should operate on current chat content, what data is eligible for storage, or whether user confirmation is required. In this skill context, vague activation semantics increase the risk of capturing sensitive or unintended information into persistent memory.
Memory-related triggers are underspecified because the metadata does not define when these phrases should operate on current chat content, what data is eligible for storage, or whether user confirmation is required. In this skill context, vague activation semantics increase the risk of capturing sensitive or unintended information into persistent memory.
The changelog explicitly introduces persistent execution-chain logging to food_log.json with timestamps, step status, compression status, summaries, and keywords, but provides no indication of consent, retention limits, redaction, or visibility controls. In a memory/compression skill, those fields can contain sensitive conversational metadata or derived personal information, creating a privacy and data-exposure risk if stored locally without user awareness.
The changelog states that when a pet 'runs away,' all associated data files are automatically deleted, but does not mention confirmation, backup, recovery, or user warning. Even if framed as game logic, this is destructive behavior in a persistence skill and can cause unexpected loss of stored memories or state, especially because the skill is explicitly designed as a cross-platform memory system.
The file's user-facing instructions, examples, prompts, and responses are entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
The examples explicitly describe pet data directories/files being deleted and memories being permanently lost after affection decay, but they provide no confirmation, recovery, backup, or user-warning guidance. In a memory-management skill, normalizing irreversible deletion through examples can lead implementers to ship destructive behavior without safeguards, increasing the chance of accidental loss of user data.
The trigger phrases are broad natural-language expressions such as '我想养宠物' and '看看我的宠物,' which can plausibly appear in ordinary conversation and unintentionally activate the skill. Because the skill can save and compress current context, accidental activation could cause unintended memory capture or state changes.
The FAQ gives directly conflicting claims about whether pets can leave and whether associated memories are permanently deleted. In a memory-management skill, inconsistent retention semantics are security-relevant because users and downstream agents may make unsafe assumptions about data durability, deletion, and recovery behavior.
One FAQ answer says memories are permanently deleted when a pet leaves, while another says saved memories in memories.json 'will not be lost.' This contradiction can mislead users about backup, recovery, and privacy expectations, creating risk of unintended retention or unexpected data loss.
The document is entirely written in Chinese and prescribes Chinese trigger and output phrases such as '今天吃什么？' and '改名叫 XXX' without any opt-in or multilingual alternative. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.
These instructions direct the model to retain real current-session content and transform it into persistent pet memory. In a memory skill, this is more dangerous than generic logging because the feature is explicitly designed to preserve user context across sessions, increasing the chance that secrets, personal data, or sensitive project details are stored and later resurfaced.
The guide explicitly instructs the agent to extract real conversation content and persist it as summaries and keywords, but it does not require informed user consent, minimization, or a retention warning. This creates a privacy and data-handling risk because potentially sensitive user content can be silently stored beyond the active session.
The example memory schema normalizes storing context_summary and context_keywords derived from user conversations in persistent memory without any accompanying privacy notice or consent flow. This is dangerous because implementers may copy the pattern directly and retain personal or sensitive conversational material on disk without user awareness.
The example format operationalizes persistent storage of user-context summaries and keywords, which encourages implementations to treat conversational retention as standard behavior. This is dangerous because examples often become de facto implementation templates, propagating insecure defaults into production use.
The guide identifies concrete on-disk storage locations for memories and metadata, including content derived from conversations, but does not warn that data will persist locally. Persistent local storage raises confidentiality risk on shared systems or developer machines, especially when users may assume the interaction is ephemeral.
The keyword extraction rules instruct the model to derive keywords from the current context on every use and merge them into long-term memory, which can accumulate sensitive topics, names, places, and preferences over time. Even keyword-only retention can become a durable profile of the user and later leak private information through recall behavior.
This code file contains natural-language descriptions and user-facing strings entirely in Chinese, starting with the module description and continuing throughout the pet profiles. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified.
