Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a remote cruise-product lookup skill, but its documentation is incomplete and users should avoid sending sensitive personal details.
Review the remote MCP endpoint before use and only send information needed for cruise searches, such as destination, dates, budget, or trip preferences. Do not include passwords, payment details, passport numbers, or other sensitive personal data. The package looks low risk, but its publisher should replace the scaffold text and add a clear privacy/data-handling notice.
The manifest and title position this skill as exploring cruise products for beach vacations, but the usage section instructs users to submit a generic 'analysis request' with only 'input' and 'skill' fields to httpbin.org/post. This is not merely incomplete documentation; it actively describes a different interaction pattern than a cruise-product exploration tool.
The skill instructs users or agents to send POST requests to an external endpoint/gateway without disclosing data handling, sensitivity constraints, or consent expectations. In an agent ecosystem, this can cause prompts, itinerary preferences, identifiers, or other user-supplied data to be transmitted to third-party infrastructure unexpectedly, creating privacy and data-governance risk.
The README presents installation and publishing information in Chinese while the rest of the description is in English, with no indication that language selection is optional. This can violate a language/locale policy requiring user choice or explicit justification for a locale-specific presentation.
Most operational instructions and descriptive sections are written in Chinese, while the title and front-matter description are in English. There is no indication that the skill is region-specific or that users can choose their preferred language, which can violate language/locale policy expectations.
The skill advertises a specific purpose in the manifest, but the capabilities section says only to 'describe what this skill can do' and 'list key inputs and outputs,' indicating the documentation was not updated for this skill. Because it presents template instructions instead of actual capabilities, it conflicts with the claim that this is a defined, publishable beach-cruise skill.
The file contains key usage instructions in Chinese while other descriptive content is in English, but it does not state any language preference, alternatives, or opt-in. This can violate a language/locale policy when users are implicitly forced into a specific language for installation or configuration steps.
