Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Chinese travel-planning skill that uses a disclosed AMAP API key and travel details to build itineraries, with privacy considerations users should understand.
Install only if you are comfortable sharing trip details such as origin, destination, dates, group composition, budget, and preferences with AMAP and, for weather, a web search provider. Use a restricted AMAP Web Service key as instructed, avoid storing it permanently in shell startup files, and remove or skip WebSearch weather lookup if you want to minimize third-party exposure.
The skill explicitly gathers sensitive itinerary attributes including origin, destination, dates, group composition, and relationship, then transmits parts of that data to external APIs and web search without an explicit privacy warning. This creates a real privacy and consent issue because travel plans can reveal location history, future whereabouts, and personal associations.
Core instructions, trigger phrases, prompts, and output template are all specified in Chinese, and the skill directs the interaction in that language by default. There is no indication that users may choose another language or that the Chinese-only behavior is a justified region-specific requirement.
The trigger phrases are broad enough to match ordinary travel-related requests, which can cause the skill to activate when the user did not specifically intend to invoke this external-data workflow. Because the skill collects personal itinerary information and calls outside services, overbroad invocation increases the chance of unintended data sharing and surprising behavior.
The skill expands its data-access surface by instructing use of WebSearch for weather, even though the declared scope is an AMAP REST API-based planner. This sends user itinerary details such as destination and travel dates to an additional external service without clear necessity, increasing privacy exposure and making behavior less predictable to users and reviewers.
