Security audit
Security checks for vulnerabilities and agentic risk
The skill is a straightforward vocabulary tracker that stores word progress locally and can create user-requested quiz reminders, with no evidence of hidden or unrelated behavior.
Install this if you want a local vocabulary tracker. Be aware it will save words, source/page details, context sentences, quiz history, and quiz state in memory/vocabulary.md by default, and only set up scheduled quizzes when you intentionally want recurring reminders.
The activation description is broad enough to match ordinary reading help, word lookups, and quiz requests, which can cause the skill to trigger in situations where the user did not intend persistent tracking or file updates. In this skill’s context, that ambiguity increases the chance of unintended data collection and stateful behavior rather than direct code execution or privilege abuse.
The skill instructs the agent to create and modify workspace files and to add words immediately by default, but it does not require a clear upfront notice that user input will be persisted. In context, this is risky because casual vocabulary assistance can silently become long-term storage, surprising users and retaining potentially sensitive reading habits, notes, or personal context sentences.
The cron setup enables recurring autonomous actions, including sending quizzes on a schedule, without an explicit warning about background behavior, duration, or how to stop it. In this context, that can lead to unwanted ongoing notifications or interactions after a one-time request, especially since the skill manages quiz state and schedules repeated runs.
The instruction says to give pronunciation in American English IPA first, which forces a specific pronunciation standard regardless of user preference. Because the file does not offer a choice of accent or locale, this can conflict with language or locale preference policies.
No suspicious patterns detected.
