Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed remote MCP connector for comparing cruise products, with no bundled executable code or local persistence.
Before installing, confirm you are comfortable sending cruise-comparison requests to the disclosed remote MCP service at olavacations.com. Non-Chinese-speaking users may find the current description under-documented, but the inspected artifact does not show hidden local code, persistence, credential access, or destructive behavior.
The user-facing description is written entirely in Chinese, and the file provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking region or audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The natural-language description in both the manifest header and embedded server.json uses Chinese only, which can impose a language requirement on users without opt-in. The policy allows locale constraints only when they are explicitly documented and justified, or when users are given a choice.
The natural-language description is entirely in Chinese, with no indication that the skill is region-specific or that users can choose another language. This can violate language/locale policy because it imposes a specific language without opt-in or justification.
