Security audit
Security checks for vulnerabilities and agentic risk
This search skill is mostly coherent, but it also exposes account-changing and public-listing actions without clearly scoping or requiring confirmation for those actions.
Review this skill carefully before installing. It is suitable for koopje.ai searches, but only use the account-changing endpoints when you explicitly intend to save, publish, remove, or renew listings, and avoid sharing precise coordinates unless needed for distance filtering.
The trigger guidance is broad enough to match many ordinary shopping or pricing requests, which can cause the skill to be invoked when the user did not specifically intend to use this external service. Unintended invocation can lead to unnecessary data disclosure in outbound queries, user confusion, and increased reliance on a third-party API without clear consent.
The skill is presented as a search capability, but the embedded documentation also exposes state-changing endpoints for saved items and user-owned listings. This creates scope expansion: an agent or integrator expecting read-only behavior may end up invoking write operations that modify account data or publish content, increasing the risk of unauthorized actions or confused-deputy behavior.
The instruction 'Report to the user in Dutch where possible' imposes a language preference that may override the user's chosen language or locale. This is a natural-language policy concern because it does not present Dutch as an opt-in or user-selected option.
The markdown documents lat/lng as raw user coordinates and describes radius filtering, but it does not warn users about the privacy sensitivity of transmitting precise location data to the API. For a markdown file, location collection and transmission that can affect user privacy should be accompanied by an explicit warning or disclosure.
No suspicious patterns detected.
