Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed remote MCP integration for retrieving cruise product information, with no local code or hidden high-impact behavior found.
Before installing, confirm you are comfortable using a remote MCP service at the disclosed olavacations.com endpoint and that Chinese-language documentation is sufficient for you. The reviewed artifacts do not show local execution, credential handling, persistence, or destructive behavior.
The natural-language description at L03 and L12 is Chinese-only, and the file does not indicate that the skill is region-specific or provide any user opt-in for language/locale. This can violate language/locale policy because it implicitly forces a specific language for users regardless of preference.
The manifest description is written entirely in Chinese and implies the skill is intended to operate in that language, but it does not state that this is an optional locale choice or a region-specific requirement. Under the language/locale policy, a skill should not implicitly force a specific language without user opt-in or clear justification.
The skill description is presented only in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative language is offered. The stated policy specifically flags forced language choices in natural-language content across all file types.
