Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent shopping price-comparison skill, but users should know searches are sent to an external shopping API and returned links may include rebate or referral tracking.
Install only if you are comfortable sending shopping search terms to maishou88.com and receiving purchase links that may include rebate or referral tracking. Avoid entering sensitive personal information as the product keyword.
The skill advertises executable networked behavior via uv run scripts/best_price.py but declares no explicit tool scope such as allowed tools or permissions. That mismatch can cause an agent to invoke network and environment-capable code without clear policy boundaries, increasing the chance of unintended external requests or access to sensitive runtime context.
The activation phrases are broad enough to match many ordinary shopping or help requests, which can cause the agent to trigger this skill in contexts where the user did not specifically ask for external price scraping or purchase links. Because the skill performs network-backed comparison and returns outbound links, overbroad routing can lead to unintended data sharing and commercially biased responses.
The manifest description and usage guidance are entirely in Chinese and direct the agent to respond with shopping results in that locale, but there is no indication that the user can choose another language. This can violate language/locale policy when the broader environment or user preference is not explicitly Chinese.
The documentation frames the script as a neutral read-only price checker, yet it admits returned links may include affiliate/rebate parameters from buyer-query interfaces. This creates a transparency and trust issue: users may be redirected through monetized tracking links or non-neutral purchase flows without informed consent.
The script sends user-supplied search keywords to a third-party API together with persistent identifier values in headers/body (notably the hardcoded/openid value and invite code) without clearly warning the user that their query will be transmitted off-platform. In this skill’s context, users may enter highly specific shopping intents, product interests, or potentially sensitive text, creating a privacy issue and unexpected data disclosure to an external service.
No suspicious patterns detected.
