Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed local schedule manager, but users should treat its saved schedules and history as private data.
Install only if you want a Chinese-language scheduling skill that saves reminders, time preferences, and execution logs locally. Do not place ~/workspace/schedule in a public or shared git repository unless you have reviewed and redacted the contents, and confirm any task that would use another skill or service before allowing it to run.
Recommending that users place the schedule directory under version control without a warning is dangerous because the directory contains personal schedules, learned preferences, and execution history. If committed to a shared or remote repository, this can leak sensitive routines, work patterns, and possibly references to tasks involving other integrated skills or services.
The manifest description is broad and natural-language driven, which can cause the agent to invoke this skill in ambiguous contexts without a clear user request to create or modify schedules. Because the skill has persistent local write behavior and may coordinate later execution of other skills, overbroad triggering increases the risk of unintended task creation, preference changes, or retention of sensitive user activity.
The skill title, instructions, examples, and responses are presented entirely in Chinese, and the license section explicitly states '完全中文化表达', but there is no opt-in or notice that the skill is Chinese-only. This can violate language/locale policy expectations when users or agent environments have not chosen Chinese as the operating language.
The skill persistently stores schedules, time preferences, and execution history under a predictable local path, but it does not prominently warn that these files may contain sensitive behavioral data. This can expose work routines, personal habits, time zones, and records of actions to other local users, backups, or tools that scan the workspace.
The usage scope lists very broad scenario keywords rather than precise invocation criteria, encouraging opportunistic activation in loosely related conversations. In this skill's context, that matters because activation can lead to persistent storage of task definitions, preference learning, and future action orchestration, all of which should require clear user intent.
L280 明确宣称“纯JSON格式，不涉及云端上传”，给人的含义是该技能整体不依赖外部云服务。但 L299-L310 又说明该技能运行在 AI Agent 平台上，并以 LLM API 作为必需依赖，因此技能使用过程本身会把用户输入发送给平台/模型服务，这与“纯本地”的表述存在意图层面的冲突。
