Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Rakuten shop analysis wrapper that sends the provided shop URL or shop code to its hosted backend and shows no local persistence, credential use, or destructive behavior.
Install only if you are comfortable sending Rakuten shop links or shop codes, plus the fact that you are analyzing them, to the hosted backend at rakuten.845817074.xyz. Do not provide credentials or private data as shop input.
The README says users can 'directly paste a Rakuten shop link' to use the skill, but it does not define a narrow trigger set or exclusion conditions. Combined with later examples like '帮我出一份这个乐天店铺的分析报告', the activation language is descriptive rather than explicitly bounded, which can lead to unintended invocation on similar everyday requests about shop analysis.
The script sends user-provided shopInput to an external third-party API endpoint without any user-facing notice, confirmation, or data-handling disclosure. Even if the input is only a Rakuten shop URL or shopCode, it may still contain sensitive business targets, internal research interests, or mistaken personal data, and the hardcoded non-official domain increases privacy and trust concerns.
The natural-language instructions and usage guidance are entirely in Chinese, and there is no indication that users may interact in other languages or that the skill is intentionally limited to a Chinese-language audience. This can conflict with language or locale policy expectations when no opt-in or justification is provided.
No suspicious patterns detected.
