Security audit
Security checks for vulnerabilities and agentic risk
This skill turns user-provided office notes into timestamped text work tickets and saves them locally, with storage behavior disclosed but worth noticing for sensitive workplace content.
Install only if you are comfortable with office notes and task descriptions being written to timestamped files under ./data/exports in the runtime environment. Avoid using it for confidential meeting notes, personal data, credentials, or regulated business information unless your environment's retention and access controls are acceptable.
The title, description, usage scenarios, and examples are all presented in Chinese, and the skill does not indicate that other languages are supported or that Chinese-only use is optional. This can amount to a language-policy constraint without explicit user opt-in or a documented region-specific justification.
The skill states that generated files are automatically saved on the server, but it does not clearly warn users that their input will be transmitted to and retained on remote storage. Users may provide meeting notes, work plans, or sensitive operational details under the false assumption that the processing is local or ephemeral.
The activation examples are phrased as ordinary, common workplace requests, making accidental or overly broad invocation more likely. This can cause the skill to process or save user content unexpectedly, especially because the skill also performs automatic server-side storage.
The docstring and returned status messages are entirely in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intentionally region-specific. The policy explicitly flags language or locale constraints when the skill does not offer a user choice or document a justified regional limitation.
No suspicious patterns detected.
