Security audit
Security checks for vulnerabilities and agentic risk
The skill is not malicious, but it should be reviewed because generic image-search requests could trigger local PhotoCHAT searches of private photos and expose file paths.
Install only if you want ordinary photo-finding requests to use PhotoCHAT. Be aware that it can search local personal photos, return absolute file paths, and display matched images; ambiguous dates should be clarified before searching.
The trigger description includes very broad everyday phrases such as 'find me a picture of...', which can match common user requests outside the intended PhotoCHAT context. This can cause unintended invocation of the skill and expose local photo search behavior or private file paths when the user did not explicitly ask to use PhotoCHAT.
The skill mandates '--day-first' and states 'Always use --day-first', forcing Australian-style date parsing without checking the user's locale or confirming ambiguous dates. For queries like 'from 03/04/2021', this can silently search the wrong date range and return unrelated or privacy-sensitive photos, making results unreliable and potentially overbroad.
The file contains many broad, conversational example phrases like 'Show me pictures...' and 'find me a picture of...' that closely overlap with ordinary user requests. In a skill-routing context, this can cause accidental or overly eager activation of the PhotoCHAT search skill, leading to unintended access to personal photo-search capabilities or incorrect tool invocation when the user did not explicitly intend to use this integration.
No suspicious patterns detected.
