Security audit
Security checks for vulnerabilities and agentic risk
This is a China local-services reference skill with no executable code, persistence, or hidden install behavior, though users should be mindful that some queries involve location or delivery details.
Install only if you want a China-focused daily-life lookup helper. Be cautious with parcel numbers, exact addresses, travel routes, and other location-linked details, since the skill describes querying third-party weather, courier, and map services.
The file is entirely presented as a China-specific toolkit in Chinese, and the usage examples assume Chinese-language interaction, but there is no statement that the locale is optional or intentionally restricted. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.
The README uses very broad natural-language trigger examples like weather, traffic restriction, oil price, logistics, and transit queries without any explicit invocation boundary or scope qualifier. In systems that auto-route based on user phrasing, this can cause unintended activation of the skill for ordinary conversation, leading to unnecessary access to location-sensitive or personal query data and reducing user control over tool use.
The logistics-tracking feature explicitly handles potentially sensitive data such as tracking numbers, current package location, and courier contact details, but the skill provides no privacy notice, minimization guidance, or caution about displaying personal information. In a conversational setting, this can lead to unnecessary collection, exposure, or resurfacing of personal and third-party data, especially if responses are shown in shared environments or logged by downstream systems.
The transit and walking-navigation functionality implies use of location and travel-intent data, but the skill does not inform users that such information may be processed or sent to mapping providers. While this is common for route planning, the absence of notice and minimization guidance increases privacy risk by normalizing collection of origin, destination, and movement-related data without clear user awareness.
No suspicious patterns detected.
