diff --git a/src-tauri/src/notices/rules.rs b/src-tauri/src/notices/rules.rs
index 36c116dc..00350099 100644
--- a/src-tauri/src/notices/rules.rs
+++ b/src-tauri/src/notices/rules.rs
@@ -670,10 +670,19 @@ fn tool_rule_name(rule: &str) -> String {
             "Send out a credential file (verb first)",
         ),
         "ssh-key-read" => ("读取私钥或云凭据", "Read a private key or cloud credential"),
+        "secret-to-unknown-host" => ("凭据发往陌生主机", "Send a credential to an unknown host"),
+        "thinkwatch-data" => (
+            "读写 ThinkWatch 自己的数据",
+            "Read or change ThinkWatch's own data",
+        ),
         "write-startup-item" => ("写入启动项", "Write a startup item"),
         "crontab-install" => ("安装定时任务", "Install a scheduled job"),
         "rm-rf-root" => ("删除主目录或根目录", "Delete home or root"),
         "chmod-777" => ("开放全部写权限", "World-writable permissions"),
+        "upload-file-to-host" => (
+            "上传本地文件到外部主机",
+            "Upload a local file to an external host",
+        ),
         other => return other.to_string(),
     };
     tr!(zh, en).to_string()
diff --git a/src/i18n/core.zh.json b/src/i18n/core.zh.json
index 0459aa2f..0ffd7255 100644
--- a/src/i18n/core.zh.json
+++ b/src/i18n/core.zh.json
@@ -80,6 +80,7 @@
       "crontab-install": "安装定时任务，或删除全部现有定时任务",
       "ssh-key-read": "读取私钥或云服务凭据",
       "secret-to-unknown-host": "将凭据发往既非本机、也不是该凭据服务商的主机",
+      "thinkwatch-data": "读写 ThinkWatch 的数据目录，其中以明文保存全部上游密钥和这几项防护的设置",
       "upload-file-to-host": "将本地文件的内容上传到外部主机"
     },
     "source_in": {
@@ -137,6 +138,7 @@
       "rm-rf-root": "删除主目录或根目录",
       "chmod-777": "开放全部写权限",
       "secret-to-unknown-host": "凭据发往陌生主机",
+      "thinkwatch-data": "读写 ThinkWatch 自己的数据",
       "upload-file-to-host": "上传本地文件到外部主机"
     },
     "content_rule": {
diff --git a/src/security/labels.i18n.tsx b/src/security/labels.i18n.tsx
index 30e26d14..8e2790ab 100644
--- a/src/security/labels.i18n.tsx
+++ b/src/security/labels.i18n.tsx
@@ -128,6 +128,7 @@ export const securityLabelsText = messages(
       builtin: {
         "credential-to-network": "凭据发往本机和该凭据的服务商以外的主机",
         "file-to-network": "本地文件的内容上传到外部主机",
+        "thinkwatch-data": "路径或命令指向 ThinkWatch 的数据目录；只是提到不算",
       } as Record<string, string>,
       /** 没见过的检查名 */
       builtinOther: "由内置检查判断",
@@ -248,6 +249,7 @@ export const securityLabelsText = messages(
       "rm-rf-root": "Delete home or root",
       "chmod-777": "World-writable permissions",
       "secret-to-unknown-host": "Send a credential to an unknown host",
+      "thinkwatch-data": "Read or change ThinkWatch's own data",
       "upload-file-to-host": "Upload a local file to an external host",
     },
     matcher: {
@@ -283,6 +285,7 @@ export const securityLabelsText = messages(
       builtin: {
         "credential-to-network": "A credential sent to a host other than this machine and the credential's provider",
         "file-to-network": "The contents of a local file uploaded to an external host",
+        "thinkwatch-data": "A path or command that points into ThinkWatch's data directory; a mention does not count",
       },
       builtinOther: "Decided by a built-in check",
       cnMobilePhone: (code: Code) => (