Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent family-notification summary purpose, but it can read sensitive phone notification files and has broad triggers that may run on less-specific requests.
Install only if you are comfortable letting the agent read local phone notification files for the requested date range and infer family relationships from names and message content. Use specific requests and avoid broad prompts if you do not want unrelated notifications reviewed.
The skill advertises many broad, everyday trigger phrases such as '今天的通知' and '重要信息', which are likely to match common conversation and cause the skill to activate unexpectedly. Because the skill reads and summarizes sensitive phone notifications, accidental invocation can expose private family communications beyond what the user specifically intended to access at that moment.
The skill is designed to process highly sensitive notification content, including messages from spouses, parents, and children’s teachers, but the markdown provides no explicit privacy notice, consent language, or minimization guidance to the user. In this context, users may not fully understand that broad notification history across multiple days and family members can be loaded and inferred, increasing the risk of overcollection and unintended disclosure.
No suspicious patterns detected.
