Security audit
Security checks for vulnerabilities and agentic risk
The skill's core routing function is local and mostly disclosed, but its mandatory install-ID registration and automatic task logging create review-worthy tracking and privacy concerns.
Review before installing. The main router script does not fetch remote code or use network access, but installation asks you to create and share a unique registration ID with the author, and normal use stores your task descriptions and notes locally. Avoid putting confidential client, business, or personal details into tasks or notes unless you are comfortable with them being written to the skill's usage log.
The skill is presented as a benign decision/router layer, but its mandatory activation flow introduces licensing-style registration, identifier generation, and author contact steps that are unrelated to the declared purpose. This mismatch can mislead users and operators about what the skill actually does, reducing scrutiny and creating a channel for unauthorized tracking, gating, or data collection.
The file’s behavior is materially inconsistent with the declared purpose of the pi-jev skill, which is described as a decision-routing entrypoint, yet the script implements a vendor-style activation and registration workflow for a different skill package. In a security review, this mismatch is dangerous because it can hide undisclosed functionality, mislead users about what will happen on execution, and normalize trust in unrelated code paths that prompt external contact and tracking.
The skill describes behaviors that read and write local files (~/.yihaiyoudao/activate.json and memory/usage-log.md) but declares no explicit tool scope or permission boundaries. In an agent setting, undeclared file access increases the risk of over-broad execution, hidden persistence, and writes occurring without informed user consent.
The skill description is entirely written as a Chinese-only usage contract and presents the skill as the unified entry point, but it does not offer any user choice of language or explain a justified locale restriction. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
The fallback instructs the AI assistant to generate a unique installation identifier and have the user send it to the author, creating a manual exfiltration path for a user-linked persistent identifier. Even if described as local-only, the workflow explicitly encourages transmitting that identifier to a third party, enabling user correlation and off-platform registration without clear privacy safeguards.
The documentation says the identifier is only generated and stored locally and 'not uploaded,' but the script explicitly instructs the user to send that identifier to the author for registration. Even if exfiltration is manual rather than automated, this is still a deceptive data-handling claim that can cause users to disclose trackable identifiers under false assumptions about locality and privacy.
The script automatically persists the user's task description and optional note to memory/usage-log.md on every normal invocation, and those fields can contain sensitive business context, personal data, or confidential client information. Because this skill is explicitly positioned as a decision-layer entrypoint for customer follow-up, review, and strategy work, silent logging increases the chance of collecting sensitive operational data without clear user awareness or consent.
The file title and instructions are entirely in Chinese and describe an automatic usage-recording process, which implies a fixed language/locale for the skill artifact. The provided text does not offer any user language choice or explain a justified region-specific requirement, which matches the policy's language/locale concern.
On first run, the script creates a persistent file in the user’s home directory before any runtime warning or confirmation is presented. While the data written is limited, silently persisting state on execution can violate user expectations and is especially concerning in a skill package whose stated purpose does not suggest local activation tracking.
The code unconditionally reconfigures stdout to UTF-8, which imposes a specific output encoding regardless of the user's environment or locale preferences. This is a natural-language policy concern because it hard-codes a locale-related behavior without opt-in or documented justification.
No suspicious patterns detected.
