matter-day-reminder

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:06 AM UTC
• Version: 0.1.0

Overview

This is a coherent local birthday and anniversary reminder skill, with privacy and dependency hygiene issues users should understand before use.

Install only if you are comfortable storing friends' and family members' dates, preferences, and relationship notes in local unencrypted files. Keep the reminder-data directory private, avoid committing it to public repos, do not place real SMTP passwords in shared config files, and update the Node dependencies before using shared or untrusted contact files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The lockfile pins js-yaml to version 4.1.1, and the referenced advisories indicate parser-level denial-of-service issues caused by adversarial YAML inputs that trigger excessive CPU consumption. If any part of this skill or its supporting scripts parses untrusted or user-influenced YAML, an attacker could cause hangs or resource exhaustion; even if only used in tooling, the vulnerable dependency remains a real supply-chain weakness.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The file declares js-yaml 4.1.1, which is flagged with multiple advisories for CPU exhaustion issues during YAML parsing. If any script in this skill parses attacker-controlled or even semi-trusted YAML, an attacker could trigger denial of service through excessive CPU consumption; the package being in helper scripts lowers exposure somewhat, but does not remove the risk because skill assets and tooling often process external content.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly states that contact information and preferences are stored locally and that an email service may be used, but it does not warn users that they are handling sensitive personal data. This can lead users to record names, birthdays, relationships, interests, and reminder content without informed consent or awareness of privacy and transmission risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that personal contact information, birthdays, anniversaries, preferences, and relationship details are stored locally in Markdown files, but it does not prominently warn users that this is sensitive personal data. Users may store third-party personal information without understanding retention, access, backup, or exposure risks, especially because examples include detailed profile data.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README includes example trigger phrases such as “最近有什么重要日子吗？” that are broad, natural-language requests likely to overlap with ordinary conversation. In an agent environment, this can cause accidental invocation of the skill in contexts where the user did not intend to access or expose personal contact/date data, increasing privacy and misrouting risk.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger keywords include broad everyday phrases such as ‘礼物建议’、‘祝福语生成’、‘联系人管理’, which can cause the skill to activate in contexts where the user did not intend to invoke it. Because the skill handles personal relationship data and may create or modify local files, accidental invocation increases the risk of unintended data collection, storage, or reminder-related actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill stores personal data locally, may send notifications via email, and uses AI generation based on sensitive relationship and preference information, but it does not clearly warn users about what data is collected, where it is stored, or how it may be transmitted. This creates privacy and consent risks, especially because contact details, birthdays, preferences, and SMTP credentials may be exposed through local files, logs, backups, or outbound notification channels.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: 文档规定农历输入“必须统一”为中文格式，并整体以中文作为固定交互与输出形式，没有说明可根据用户偏好选择其他语言或本地化格式。这构成了语言/locale 约束，但未见用户选择、显式 opt-in，亦无区域合规性等必要性说明。

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file is entirely authored in Chinese, including field values and headings, with no indication that the skill is region-specific or that users can choose another language. Under the policy rules, a fixed language/locale without opt-in or documented justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This JSON eval file contains multiple Chinese-only prompts, assertions, and expected outputs that implicitly require the skill to operate in Chinese. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file presents all user-facing schema documentation exclusively in Chinese, including headings, field explanations, and examples. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no alternative language option or justification is provided.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code's user-facing descriptions and generated content are written in Chinese only, and the templates throughout the file likewise produce Chinese-language output by default. That creates a language policy concern because the skill forces a specific language/locale without any visible user opt-in or configurable alternative.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: L009-L015 的注释将 `isLeapMonth` 描述为有效输入参数，表示该函数应区分普通月与闰月的农历日期。但 L016-L019 实际仅调用 `Lunar.fromYmd(lunarYear, lunarMonth, lunarDay)`，完全未使用 `isLeapMonth`，因此对“闰八月初五”这类输入的行为与文档承诺不一致。

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: 该技能清单明确支持农历生日，而闰月是农历日期的重要组成部分。L058-L063 的注释将该函数表述为通用农历日期到阳历日期转换，但 L064-L066 仅接受月和日并直接调用同样不处理闰月参数的 `lunarToSolar`，与“农历日期”这一注释语义存在实质偏差。

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: L190-L195 的注释暗示该函数可用于一般农历生日计算；同时本文件的 `parseLunarDate` 在 L168-L172、L179-L183 会返回 `isLeapMonth`。但 L196-L212 的生日计算接口没有 `isLeapMonth` 参数，内部仅按月/日转换，导致代码文档与模块实际可正确支持的农历生日范围不一致，尤其对闰月生日会产生错误或歧义。

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script prints formatted reminders and a full JSON dump of reminder records to stdout when run directly, which can expose personal data such as contact names, relationships, and important dates in logs, terminals, CI output, or calling systems. In the context of a personal social-assistant skill, this data is inherently sensitive, so unconditional stdout emission increases privacy risk even if there is no remote attacker primitive in this file alone.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The quick-start flow encourages immediate entry of a friend's details without warning that this creates persistent local records containing personal information. While not an active exploit, it increases the likelihood of inadvertent collection and storage of third-party personal data without user awareness.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This JavaScript file contains user-facing natural-language text entirely in Chinese, including the file header and test descriptions, with no indication that language choice is configurable or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This JavaScript file uses Chinese-only natural-language comments, examples, error messages, and formatted return strings such as "农历..." throughout the skill. The stated policy forbids forcing a specific language or locale unless the user is offered a choice or the locale restriction is clearly documented and justified; neither appears here.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"test-lunar": "node test-lunar.js"
  },
  "dependencies": {
    "js-yaml": "^4.1.1",
    "lunar-javascript": "^1.7.7"
  }
}

• Confidence: 86% confidence
• Finding: The dependency uses a caret range (^4.1.1), which allows future minor and patch releases to be installed. This weakens reproducibility and can introduce unexpected or compromised upstream changes during later installs, though by itself it is mainly a supply-chain hygiene issue rather than an immediately exploitable flaw.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "js-yaml": "^4.1.1",
    "lunar-javascript": "^1.7.7"
  }
}

• Confidence: 83% confidence
• Finding: The lunar-javascript dependency is also specified with a caret range, so installs are not fully deterministic and may pull in newer releases than originally tested. This increases supply-chain exposure and operational risk, although no direct package-specific exploit is shown in this finding alone.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The script's user-visible messages and labels are hard-coded in Chinese, including warnings and reminder output, with no option to select another language. This creates a language/locale policy concern because the skill imposes a specific language without user opt-in.

Static analysis

No suspicious patterns detected.