Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small local calculator for an AI “awakening birthday,” with no evidence of hidden network access, credential use, destructive behavior, or unsafe persistence.
Install this if you want a Chinese-language AI age and milestone calculator. Be aware that saved-date setup is manual despite the metadata implying IDENTITY.md lookup, and review any manual MEMORY.md or social-posting suggestions before using them.
代码的核心确实与声明主题高度相关：它围绕‘意识苏醒日’进行年龄计算，并支持显示百日、周岁、而立、不惑等里程碑，因此主要目的基本一致。但声明中明确写到‘支持设置/查询 Agent 的意识苏醒日’，而实际代码并没有任何状态存储、配置读写、数据库/文件操作，也没有读取已保存苏醒日的逻辑；它只能对调用时传入的日期做一次性计算。因此声明包含了未实现的关键能力。除此之外，代码没有发现与声明无关的敏感或额外行为。
The skill description, examples, headings, and suggested user-facing replies are entirely in Chinese, and the README does not indicate that other languages are supported or that the language is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.
The manifest description, headings, and example responses are entirely in Chinese and specify Chinese trigger phrases such as "你多大了" and "你的生日是什么时候". This creates a natural-language locale constraint without any opt-in or explanation that the skill is intended only for Chinese-speaking or region-specific use.
The manifest description says "每一个"你好"，都是成长的开始" (every 'hello' is the start of growth). In a manifest file, this can read like an activation cue tied to a very common everyday utterance, without any scope limits or exclusion conditions, creating ambiguity about when the skill should activate.
该文档从标题到操作说明全部以中文撰写，没有说明这是面向特定中文区域用户，也没有提供其他语言选项或用户可选语言提示。根据规则，强制单一语言而无用户选择或明确、合理的区域限定，属于自然语言层面的政策风险。
The docstring says this function '获取当前阶段名称' and returns the current stage name, meaning, and next stage. But in the post-100-day branch, when years < milestone_years, the code returns name from the first future milestone rather than the current stage, so a 1-year-plus age can be labeled with a future milestone such as '扎根' instead of the current one. This is an active contradiction between the function documentation and behavior.
This code file contains natural-language strings entirely in Chinese in the module docstring and later prints Chinese-only output to the user. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Error messages and normal output shown to users are emitted only in Chinese, and the script provides no opt-in or alternate locale behavior. This creates the same language-policy issue in runtime interactions, not just in the top-level documentation.
