Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local shift-work sleep planner whose file writes are disclosed and limited to a local JSON log.
Before installing, understand that it stores shift schedules, sleep times, quality ratings, and notes in `shift_sleep.json` in whatever directory you run it from. Avoid entering sensitive health details you do not want stored locally, and treat the screening output as informational rather than medical advice.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
# ---------- plan ----------
def day_plan(kind: str, sched: dict, is_first_night: bool, prev_kind: str) -> list:
"""Return instruction lines for one roster day of block kind."""
shifts = sched["shifts"]
lines = []
a0, a1 = sched["anchor"]
The skill documentation indicates local file read/write behavior via shift_sleep.json in the current working directory and logging/report commands, but it does not declare any explicit tool scope or permissions. This creates a permission transparency gap: an agent or reviewer may assume the skill is purely advisory while it can persist or access local data, increasing the risk of unintended file access or writes in a broader execution context.
No suspicious patterns detected.