Security audit
Security checks for vulnerabilities and agentic risk
This skill is a journaling logger that openly writes user thoughts to disk, but it also forces raw content previews and keeps full entries without a consent or retention boundary.
Install only if you want an agent to save full thought/journal text in local workspace files. Avoid putting passwords, secrets, regulated data, or highly private material into entries unless you are comfortable with that text being stored and echoed back in chat previews.
The skill requires ingesting the user's entire raw message, storing it, and then reflecting portions of it back. In the context of a journaling or 'thought record' workflow, users are especially likely to provide intimate, sensitive, or secret material, so the instruction creates a strong data leakage pathway both at rest and in the assistant's response.
Requiring the first and last 100 characters of the stored content to be returned as proof directly exposes user-provided text in the assistant's reply. This is dangerous because secrets and personal details often appear at the beginning or end of free-form notes, and the disclosure happens even when no such preview is necessary for functional confirmation.
The 'important constraints' section reinforces mandatory disclosure of the first and last 100 characters, making the leak a required behavior rather than an incidental one. Because the skill frames this as the only acceptable proof of write, it systematically normalizes response-time exfiltration of sensitive stored content.
The skill clearly directs the agent to execute a Python script that reads user content from stdin and writes it to disk, but the metadata declares no explicit tool scope or permissions. In practice this creates an authorization and review gap: operators cannot easily tell that the skill needs file read/write capabilities, and agents may be induced to perform filesystem actions without clear policy boundaries.
The skill instructs the agent to persist the user's full raw message to disk with no warning, consent flow, retention guidance, or filtering for sensitive information. That creates privacy and compliance risk because users may include secrets, personal data, or regulated content that becomes stored unintentionally and durably.
The instructions require the agent to return only a fixed Chinese confirmation format, regardless of the user's preferred language. This is a natural-language policy issue because it imposes a specific language without opt-in or a documented region-specific justification.
The script returns prefix and suffix excerpts from the entire recorded file after writing, which can expose previously stored thoughts and other sensitive user content to the caller. Because the file is append-only and reused across entries for the same day, a user submitting benign input can still receive snippets of earlier records, creating an unintended cross-entry information disclosure.
No suspicious patterns detected.
