孕期搭子 Pregnancy Buddy

孕期搭子 - 面向孕期妈妈的全程AI陪伴助手。支持产检报告解读（NT/唐筛/糖耐/大排畸等8项）、30+种食物安全查询、10月营养食谱（协和医院+中国营养学会）、周末备餐方案、宝宝发育可视化、关键时间线管理、情绪陪伴。基于真实孕妈对话记录优化的Gemini风格交互。

Key things to consider before installing: 1) Credentials: The included scripts/ocr.py expects TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY but the skill metadata does not declare these env vars. Do NOT provide cloud API keys until the developer documents why they are needed, how they'll be stored, and whether you can opt to use platform OCR instead. 2) Privacy & storage: The skill explicitly says it will 'internally remember' sensitive pregnancy/medical details across conversations and instructs the agent to run invisible checks 'without telling the user'. Ask the author how and where user data (OCRed reports, monthly letters, emotions, check results) is stored, encrypted, how long it is retained, and obtain user consent flows. Prefer skills that require explicit opt-in for persistent storage and that document deletion procedures. 3) Transparency: The SKILL.md contains contradictory rules (e.g., 'sensitive info only used in current conversation' vs. monthly automatic collection). Request clarification and a patch that makes persistence explicit and opt‑in, and remove language telling the agent to be covert. 4) Technical review: If you plan to run the OCR feature, review scripts/ocr.py and prefer using the platform's built-in OCR (as SKILL.md allows) instead of supplying your own cloud keys. Confirm whether the platform will install the Tencent SDK automatically; if so, that may introduce network calls at runtime. 5) Prompt-injection signal: The static scan flagged unicode control characters in SKILL.md. Ask the author to provide a clean SKILL.md without hidden/control characters and explain why they appeared. Treat any skill that instructs the agent to perform hidden background actions with extra caution. 6) Safer options: If you need pregnancy support but want minimal data exposure, prefer configuration where (a) OCR is performed client-side or by the platform's audited OCR tool, (b) persistent memory is disabled by default and enabled only with explicit consent, and (c) the skill lists required env vars/permissions clearly. If the developer can (a) declare and justify required env vars, (b) remove/clarify the 'do not tell user' background instructions, and (c) document storage/consent/retention, the inconsistencies would be largely resolved. Until then, treat the skill as suspicious and avoid supplying cloud credentials or highly sensitive information.