Security audit
Security checks for vulnerabilities and agentic risk
This is a small NeoBoost integration skill whose API-key and curl requirements fit its stated brand analytics purpose, with no hidden code or persistence found.
Install this only if you intend to use NeoBoost and are comfortable configuring a NeoBoost API key. Treat brand, competitor, prompt, and content-generation requests as information that may be processed by the NeoBoost service, and avoid sending sensitive business data unless that matches your account and privacy expectations.
The trigger description activates on broadly phrased requests about brand visibility, health, competitors, and 'similar' queries without clear boundaries or confirmation steps. In an agent environment, this can cause over-invocation of the skill and unintended transmission of user/business data to the external NeoBoost service using the configured API credential.
The skill metadata shows it requires an external API key and uses curl to access a third-party service, but the user-facing description does not warn that requests may leave the local environment or consume privileged credentials. This undermines informed consent and can lead users to disclose or process sensitive business information without realizing it is being sent to NeoBoost.
The markdown guidance says the skill should trigger for requests like the listed examples and '......', which effectively expands activation to unspecified similar content. This ambiguity increases the chance the agent will invoke the skill in contexts the user did not clearly intend, potentially exposing sensitive brand or account data to an external service.
All user-facing descriptive text and setup prompts in the skill file are written only in Chinese, with no indication that other languages are supported or that Chinese is a region-specific requirement. This may violate language/locale policy where user choice or explicit justification is required.
No suspicious patterns detected.
