Security audit
Security checks for vulnerabilities and agentic risk
This fridge inventory skill stores a local inventory and change log for expiry tracking, with no hidden code, network access, or credential behavior found.
Before installing, understand that this skill keeps a local `family/fridge.json` inventory and a history of food additions, consumption, and discards. That is appropriate for expiry tracking, but users sharing a workspace may want to periodically clear or trim the log.
Keeping a complete append-only log of every add, consume, and discard action can reveal behavioral patterns such as shopping habits, diet, travel, and household routines beyond what is needed for current inventory state. Even though the feature supports auditability, long-lived detailed logs increase the blast radius if the workspace is later exposed or accessed by other tools.
The skill persists household inventory data to a workspace file and logs all mutations, but the user-facing description does not clearly disclose this persistence behavior. That creates a transparency and privacy issue: users may provide household consumption and inventory details without realizing they are being retained on disk and accumulated over time.
The title labels this reference as "English," which imposes a language choice in the skill content. Under the policy, language constraints should either be user-selectable or clearly justified as region- or compliance-specific, neither of which is stated here.
The title explicitly labels the file as a Chinese version, and the entire document is written in Chinese. For a generally applicable food storage reference, forcing a single language without user opt-in can violate language/locale policy expectations.
No suspicious patterns detected.
