Security audit
Security checks for vulnerabilities and agentic risk
This is a route-planning skill with some broad triggers, but no hidden execution, persistence, credential handling, or unrelated behavior was found.
Install this only if you want a route-planning assistant that may activate on broad route or location words and may present Chinese-labeled output. Avoid sending sensitive home, work, or travel locations unless you are comfortable with route queries being processed through the disclosed map-provider workflow.
The trigger list includes very broad terms such as "哪里", "route", "distance", and "driving" that are common in ordinary conversation and can cause the skill to activate outside its intended context. Over-broad activation increases the chance of prompt hijacking of unrelated interactions, accidental invocation, and unintended access to location-related user queries.
The description states the skill will automatically recognize place names and travel routes, which implies broad activation without defining explicit triggers or user-scoped conditions. In an agent ecosystem, ambiguous auto-activation can cause the skill to engage on unrelated conversations, leading to unintended processing of user input and over-collection of context.
The manifest description is written only in Chinese and suggests a Chinese-language interaction mode without indicating user choice or multilingual fallback. This can cause unexpected language switching or exclusion of users who did not opt into Chinese, increasing the risk of confusion, consent issues, and incorrect routing or travel guidance.
The skill description and output structure prescribe bilingual content elements and Chinese-labeled sections, but the file does not state that the language should follow user preference or provide an opt-in choice. This can create a locale-policy issue if the skill forces a particular language presentation without explicit user selection.
No suspicious patterns detected.
