Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to do what it says, but it can expose private Mail, Calendar, and Notes data and sends stock symbols to Tencent for quotes.
Install only if you are comfortable letting an agent read unread Mail metadata, Calendar event titles/times/locations, and Notes search snippets on macOS. Treat the JSON output as private data, and be aware that stock quote commands contact Tencent's quote service with the requested symbols.
The skill invokes Python and osascript and, per its description, includes stock quote functionality that implies network access, yet it declares no explicit tool scope or permissions boundary. This weakens least-privilege controls and can let an agent invoke broader shell/network-capable behavior than users or orchestrators may expect.
The skill explicitly reads Mail, Calendar, and Notes, which commonly contain highly sensitive personal and business information, but the warning section mentions only permission prompts and automation denial behavior. Users and calling agents may therefore authorize or use the skill without understanding the privacy sensitivity or data exposure risk of the returned JSON.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _run(cmd, input_text=None):
p = subprocess.run(cmd, input=input_text, text=True, capture_output=True)
return p.returncode, p.stdout, p.stderr
The code reads Mail inbox metadata and returns sender, subject, dates, and message IDs without any in-code consent, warning, or data-minimization control beyond a row limit. In an agent-skill context, this can expose sensitive personal or business communications to downstream consumers who may not realize the skill accesses private mailbox contents.
The Notes search function can search note titles and bodies and returns content snippets, which may include secrets, personal information, or sensitive business material. In this skill context, that is more dangerous than ordinary app automation because the feature is explicitly designed to retrieve and exfiltrate content from a private knowledge store into agent-visible JSON output.
The calendar functions enumerate events and return titles, times, and locations without any warning or consent flow. Calendar entries often reveal travel, meetings, health visits, or customer information, so exposing them through an agent skill can leak sensitive operational and personal data.
The skill is described as a macOS read-only local query tool, but it also makes outbound network requests to a third-party stock quote service. That creates a trust-boundary mismatch: operators may approve the skill expecting only local data access, while the code can still contact external infrastructure and disclose usage patterns or queried symbols.
The natural-language description and all listed trigger patterns are only in Chinese, which implies a language-specific interaction model without any stated opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a natural-language policy concern.
The trigger phrase "行情" is very generic and can match ordinary conversation about markets or prices, causing the skill to activate unexpectedly. Because this skill has access to the exec tool and can query local macOS apps, over-broad invocation increases the chance of unintended access to user data or system actions even if the skill is described as read-only.
The natural-language description and usage guidance are presented only in Chinese, which can amount to a language-policy violation when no user opt-in or multilingual alternative is offered. There is no indication that this skill is region-specific or intentionally limited to Chinese-speaking users.
The code performs outbound HTTP(S) requests to a third-party endpoint without any user-facing disclosure, which can leak queried stock symbols, timing, and client metadata such as IP address to the remote service. While the destination is allowlisted and not user-controlled, the undisclosed network egress still violates least surprise and can matter in restricted or privacy-sensitive environments.