Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language Pinduoduo coupon guidance skill with no executable code, permissions, persistence, or credential access.
Install only if you want Chinese-language Pinduoduo coupon-shopping assistance. Verify any claimed prices, discounts, rebate links, paid plans, or contact channels yourself before spending money, because the skill text describes shopping offers but does not provide a trusted coupon source or enforcement mechanism.
The description claims broad capability across all product categories without meaningful scope boundaries, which increases the chance the orchestrator routes a wide range of ordinary commerce requests into this skill. In context, this is more dangerous because shopping requests are common and highly overlapping, so ambiguous matching can systematically hijack benign user intents.
The example trigger phrase is extremely broad for a shopping-domain skill and can match ordinary user shopping requests that are not explicit invocations of this specific tool. That creates over-triggering risk, where the agent may activate the skill unexpectedly, causing inappropriate responses, affiliate-style redirection, or unintended handling of general shopping queries.
The manifest text uses Chinese-only natural-language fields (the description and author name) with no indication of language choice or user opt-in. Under the policy for natural-language violations, this can be considered a language/locale constraint that is not documented as optional or region-specific.
