Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent personal memory skill with local markdown storage and an optional, disclosed vector-search feature, but users should be aware of the persistent memory and optional embedding-provider data flow.
Before installing, decide whether you want a persistent agent memory system at all. Keep sensitive secrets out of the memory files, resolve the daily-review directory mismatch, and only enable Gemini-based vector search if you are comfortable sending memory text to an external embedding provider.
The core documentation defines Daily Review files under memory/diary/[date].md, but the initialization and creation examples later use memory/daily. This is an active contradiction in the skill's own instructions and can cause the agent to write to a different location than the one the skill declares.
The rule explicitly requires all memory entries to be written in bilingual format and says it applies regardless of the original context language. This imposes a specific language policy without offering user choice or opt-in, which matches the locale/language policy violation criteria.
The optional vector search section expands the skill from local file-based memory into external/networked behavior by encouraging use of Gemini API keys and local Ollama HTTP access. That increases attack surface, creates data exfiltration risk for memory contents sent to embedding providers, and may cause agents to interact with services not expected from a simple memory skill.
The skill description is presented entirely in Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. Under the policy rules, forcing a specific language without opt-in is a natural-language policy issue.
No suspicious patterns detected.
