Security audit
Security checks for vulnerabilities and agentic risk
The skill claims to provide technology news, but its actual instructions are for location-based venue discovery with queues, parking, navigation, and reviews.
Review this skill carefully before installing. It appears to be mislabeled: users expecting technology news may instead get guidance that asks for or uses location-based venue information such as distance, queues, parking, navigation, and reviews. It should be corrected so the name, description, examples, and returned fields all describe the same purpose.
The skill is labeled as technology news, but its body documents location-based venue discovery, queueing, parking, and review features. This mismatch can cause an orchestrator or user to invoke the skill under false assumptions, leading to misrouting, unsafe tool chaining, or unintended access to location/contextual workflows that are unrelated to the declared purpose.
The inline documentation explicitly describes restaurant/POI-style discovery behavior despite the stated intent being technology news. Contradictory instructions increase the risk of prompt confusion and incorrect capability selection, which is especially dangerous in agent environments where downstream systems may trust documentation to decide what data to collect or what tools to call.
The description and example requests are ambiguous and inconsistent, making it unclear when the skill should trigger and what problem it solves. In an agent setting, this can cause accidental invocation, poor routing, and user confusion, which weakens reliability and may expose unrelated functions if the system attempts to infer missing behavior from conflicting text.
All user-facing natural-language content is presented in Chinese, and the file does not indicate that users may choose another language or locale. Under the stated policy, a fixed language without user opt-in can be a language or locale policy violation.
No suspicious patterns detected.
