Security audit
Security checks for vulnerabilities and agentic risk
This flashcard skill is coherent and locally stores study decks as expected, with no evidence of network exfiltration, privilege escalation, or hidden behavior.
Before installing, users should understand that flashcard fronts, backs, tags, and review history can be saved locally in a JSON file. Avoid pasting highly sensitive notes unless the local storage location is acceptable for your environment.
The documented purpose is a simple flashcard generator, but the finding indicates undeclared filesystem read/write behavior and a mismatch between advertised automatic generation and actual behavior. Undeclared local persistence increases risk because users may expose notes or study material to storage they did not consent to, and behavior mismatches undermine trust and can hide broader unsafe functionality.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
The DATA DISCLAIMER states as a factual behavior claim that the software 'processes and stores data locally' and 'does not transmit data externally unless explicitly configured by the user.' In this file, however, there is no supporting implementation at all—only product/marketing documentation—so the documentation makes concrete operational assurances not substantiated by code here, which is an intent/documentation divergence.
The _save method persists the full deck to a local JSON file, which affects user data by storing potentially sensitive study content on disk. There is no confirmation prompt, log message, or inline disclosure near the write operation to make this persistence behavior visible to the user.
No suspicious patterns detected.