Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Alipay bill-summary skill that schedules disclosed recurring financial reports, with privacy and timing caveats users should review.
Before installing, confirm you want recurring Alipay financial summaries, review the report frequency, threshold, timezone, and authorization scope, and disable or edit the cron jobs if you do not want automatic reports.
The trigger list includes broad everyday phrases such as '消费分析' and '账单报告', which can cause the skill to activate when the user did not specifically intend to access this financial-summary workflow. Because the skill handles sensitive billing data, accidental activation increases privacy risk and may lead to unintended access, scheduling, or disclosure of personal financial information.
The skill describes detailed financial summarization capabilities but does not present a clear user-facing privacy notice about the sensitivity of transaction data, what categories will be accessed, how much history is processed, or where summaries may be delivered. In a finance context, this omission is dangerous because users may authorize or schedule recurring reports without understanding the exposure of spending patterns, payment methods, and large transactions.
The cron examples hardcode the timezone as Asia/Shanghai without indicating that this should be confirmed with the user. While not directly enabling code execution or data exfiltration, it can cause reports to run at unintended times, which may expose sensitive summaries when the user is not expecting them or conflict with the user's actual locale.
No suspicious patterns detected.
