Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple referral-code lookup that uses a disclosed public API and does not include local code execution, persistence, credential access, or hidden behavior.
Before installing, understand that referral lookups send the brand or domain you ask about to ReferralCodes.com and may return third-party referral links or codes. Avoid using it for confidential vendor research or internal project names unless that disclosure is acceptable.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
---
## Output rules
### If referrals are found:
The activation guidance includes broad phrases like "signup offers," "new user sign-up extras," and "app download incentives," which can overlap with ordinary discount or promotion requests not specifically about referrals. The file does not provide negative examples or boundaries clarifying when the skill should not activate.
The skill sends a user-derived brand or domain to an external public API without clearly warning the user. Even if the payload is usually low sensitivity, user queries can contain sensitive business interests, internal project names, or private vendor research, and the silent transfer violates transparency and can create privacy/compliance risk.
No suspicious patterns detected.