Security audit
Security checks for vulnerabilities and agentic risk
This is a local reading-and-note-taking skill with some under-specified and inconsistent documentation, but no artifact-backed evidence of deception, exfiltration, persistence abuse, or destructive behavior.
Install only if you are comfortable letting the agent read the documents you point it at and write Markdown notes to the chosen output path. Avoid using callback_url unless you trust the destination, and convert PDFs to text first because the free-version documentation is inconsistent about direct PDF support.
The skill supports local note saving and an optional callback URL but provides no clear warning about what data may be written locally or transmitted externally. Because the workflow processes user-supplied documents and reflections, sensitive content could be persisted on disk or sent to attacker-controlled endpoints without informed consent or adequate restrictions.
The skill says users can trigger the workflow through natural-language instructions and that the tool will automatically execute corresponding operations, but it does not define strict invocation boundaries or confirmation requirements. In an agent environment with exec/write tools enabled, overly broad trigger language can cause unintended command execution, file writes, or processing of sensitive local content based on ambiguous prompts.
The FAQ explicitly states that the free version supports only plain text and Markdown, and that PDF files must be converted first, while the example command uses --input paper.pdf as if direct PDF input were supported. This is an active contradiction in the skill's own documentation about what the tool does.
The documentation states the skill runs locally, needs no API key, and uses an agent's built-in LLM, which suggests no separate network-facing integration by the skill itself. However, the error handling section includes 'network errors' and instructs users to test connectivity with ping, implying network operation is part of the skill's behavior; this creates conflicting intent signals in the documentation.
The skill name and surrounding instructions are presented in Chinese, and the document does not indicate that users may choose another language or that the Chinese-only presentation is an intentional locale constraint. This can be a language policy issue when a skill implicitly forces a language without user opt-in.
