Security audit
Security checks for vulnerabilities and agentic risk
This skill only queries New Zealand traffic information from the public NZTA Traffic and Travel API and does not show hidden, persistent, credential-seeking, or destructive behavior.
Install this if you want a command-based helper for New Zealand state highway traffic, closures, roadworks, and camera lookups. Be aware it contacts trafficnz.info and should be used for NZTA/New Zealand highway questions rather than generic traffic requests.
The skill invokes a shell script but does not declare any tool scope or allowed-tools restrictions, so an agent may be permitted to execute shell commands more broadly than intended. In an agent environment, this weakens containment and can enable unintended command execution paths if the skill is triggered or modified later.
The manifest description includes example invocations such as "how's the traffic" and "any road closures," which are broad natural-language phrases that could be used in ordinary conversation outside an explicit request to invoke this skill. The description does not provide tighter activation constraints or negative examples to clarify when the skill should and should not trigger.
No suspicious patterns detected.
