Security audit
Security checks for vulnerabilities and agentic risk
This scheduler skill is mostly coherent, but it gives agents recurring local execution guidance without enough guardrails for destructive tasks or clear data-flow disclosure.
Review before installing if you plan to let it run real operational tasks. Use it only with explicit task-by-task approval, avoid scheduling destructive cleanup or backup commands without dry runs and restore tests, and treat task names/descriptions as potentially visible to the host agent or LLM service despite the local-storage claims.
The trigger scope is broad and ambiguous, covering loosely related planning, tracking, and automation scenarios without tight constraints on what actions require confirmation. In a scheduling skill with exec capability, this increases the chance the agent will over-apply the skill to sensitive or destructive workflows and set up recurring actions without sufficiently specific user authorization.
The skill includes scheduled backup and cleanup operations affecting local data, including deletion of old backups, but does not present a clear warning, confirmation requirement, or safety guardrails. In an automated recurring context, even a small misunderstanding can lead to repeated data loss, unintended retention changes, or destructive operations running unattended.
The skill claims it is fully local and requires no cloud/API key, yet also states it depends on an LLM API model route provided by the agent platform. This contradiction can mislead users into believing no off-device processing occurs, causing unintentional disclosure of task contents, schedules, or operational metadata to a remote model service.
The license/copyright section states "完全中文化表达，适配中文用户工作流," indicating the skill is designed to operate in Chinese only. This is a natural-language locale constraint without any documented user choice or opt-in, which can violate language/locale policy expectations.
The example code creates directories and initializes persistent JSON files as soon as the snippet is run, with no surrounding warning that it will write into the user's home workspace. In a skill context, users may copy or execute examples expecting them to be illustrative only, so silent filesystem modification can cause unintended state changes, data clutter, or overwrite/interaction risks with existing scheduler data.
L119-L123 的“完整配置”示例直接定义 class FullScheduler(CronScheduler)，而全文此前并未提供 CronScheduler 实现；同时 L313-L318 宣称仅依赖标准库即可运行。该文档给人的意图是可按文中内容本地搭建完整调度器，但实际示例缺失核心实现，和“完整搭建/完整配置”的表述不一致。
The natural-language headings, comments, docstrings, and user-facing print strings are all in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale. Under the stated policy, forcing a specific language without opt-in is a policy concern.
