Security audit
Security checks for vulnerabilities and agentic risk
This is a local task, pomodoro, and habit tracker whose file writes and delete behavior match its stated purpose.
Install only if you are comfortable with a Chinese-language local tracker that stores its data in ~/.task-tracker. Be aware that the delete command removes local task entries immediately and does not ask for confirmation.
The skill title, description, usage examples, and commands are all presented only in Chinese, which indicates a fixed language/locale for interaction. There is no indication that users may choose another language or that the Chinese-only constraint is justified as region-specific.
The manifest’s natural-language fields, including the top-level description and every command description/usage, are written only in Chinese. For a general-purpose task tracker, this imposes a specific language/locale without any opt-in, alternative locale, or stated region-specific justification, which matches the language policy violation criteria.
Docstrings, help output, and status messages are presented in Chinese, and the script does not provide any user opt-in or alternative locale selection. This can violate language or locale policy when tools are expected to avoid forcing a specific language without user choice.
The delete_task function irreversibly removes a task entry from the local tasks file, but it does so immediately after receiving the task ID. Although it prints a message after deletion, there is no confirmation prompt or pre-action warning before the destructive operation occurs.
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
return
# 更新连续天数
yesterday = (date.today() - __import__('datetime').timedelta(days=1)).isoformat()
if habit.get("last_check") == yesterday:
habit["streak"] += 1
else:
No suspicious patterns detected.