Security audit
Security checks for vulnerabilities and agentic risk
The bundled planner has limited local access, but its calendar features are incomplete and its optional Windows app needs separate review.
Expect a basic weekly outline requiring manual completion. The supplied CSV does not match the script's parser, so do not rely on its fields being used. Choose a dedicated output folder to avoid overwriting an existing plan.md. The optional Windows app is unnecessary for the planner and requires its own security review; a matching publisher-provided hash alone does not establish safety.
The code provides a dated weekly skeleton, but omits several defining features of the declared calendar builder. The seasonal-date guardrail is only static text, not implemented seasonal mapping. Local input reading and output writing support the stated purpose; no unrelated access or undeclared external activity is evident.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Guardrails (hard rules)
- Never put a seasonal moment in the plan without checking the date for that year.
- Never plan a sponsored slot without the disclosure line written into the slot.
- Never fill a slot with a statistic or a claim that has no source.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
day += step
report.append("")
report.append("## Guardrails to keep")
for rule in ["Never put a seasonal moment in the plan without checking the date for that year.", "Never plan a sponsored slot without the disclosure line written into the slot.", "Never fill a slot with a statistic or a claim that has no source."]:
report.append(f"- {rule}")
write_out(out_dir, "plan.md", report)
The calendar entries contain only weekly dates and either the initial focus or the placeholder 'next block'; the code never assigns owners or channels or maps US seasonal moments to their weeks. Appending a reminder to check seasonal dates does not implement the seasonal mapping described in the manifest.
No suspicious patterns detected.