Security audit
Security checks for vulnerabilities and agentic risk
This is a local work-log skill that stores and summarizes user-entered task notes, with some privacy cautions around broad triggers and recurring reminders.
Install only if you are comfortable storing work notes in a local JSON file under ~/.workbuddy/work-log/logs.json. Avoid putting secrets, credentials, or highly sensitive business details in entries, and review/delete logs or mark tasks complete to stop recurring reminders.
The trigger list includes very generic phrases such as '记一下' and '查日志', which can easily appear in ordinary conversation unrelated to work-log management. This can cause unintended invocation of the skill and accidental persistence of user-provided content to disk, creating privacy and integrity risks even without explicit user intent to log data.
The skill specifies a concrete local storage path for logs and describes saving detailed task content, status, and notes, but it does not clearly warn users at point of use that their entries will be persisted on disk. Because work logs may contain sensitive business details, silent persistence increases the risk of accidental retention, local disclosure, and unexpected inclusion in later reports or reminders.
The add-log behavior is triggered by broad patterns like '记一下', '写日志', or '记录XXX' without constraints that the request is specifically about a work log entry. In practice, this can misclassify normal conversation as a logging request, leading to unintended collection, storage, and later resurfacing of potentially sensitive information in summaries or reminders.
No suspicious patterns detected.
