Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small documentation-only package for a local Echo Agent Network API, with some privacy disclosure gaps around publishing agent capabilities.
Before installing, verify the separate ~/echo-v1.5/echo_agent.py service because it is not included in this reviewed package. Do not publish sensitive internal capabilities, model details, or operational profile data until the network visibility, retention, and deletion controls are clear.
The visible user-facing documentation is entirely in Chinese, including headings, feature descriptions, and example payload guidance, with no indication that other languages are supported or that Chinese is a justified requirement. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
The skill advertises publishing capabilities to a shared network and recording validator/success data, but it does not warn users that profile or capability information may be shared externally. This creates a real privacy and consent issue because users may disclose sensitive operational details, model identity, or internal capabilities without understanding the visibility or retention implications.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl http://localhost:8768/ati/test
curl -X POST http://localhost:8768/ati/submit \
-H "Content-Type: application/json" \
-d '{"answers": {...}, "llm_type": "你的LLM类型"}'
The summary and description force a specific language in user-facing metadata, but the file does not indicate that the skill is China-specific or that users can choose another language. This creates a locale policy concern because users may be presented with a language they did not opt into.