Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent travel checklist skill with limited, disclosed data use and no executable code, persistence, or hidden authority.
Installers should expect Chinese-language instructions and output templates. Before connecting travel accounts, confirm you want the skill to read only minimal itinerary fields such as dates, locations, carrier or hotel details, and baggage rules; it explicitly says not to request or store passport numbers, payment details, API keys, or tokens.
The file’s user-facing description is entirely in Chinese, which can impose a language requirement on users without opt-in. Under the policy, forcing a specific language without offering a choice or justification is a natural-language policy violation.
The package description at L04 is entirely in Chinese and provides no indication that the skill supports other languages or that this locale restriction is intentional. Under the policy, forcing a specific language without user choice or justification is a natural-language policy concern.
The default prompt is hardcoded in English ('Use $travel-checklist-hy...'), which imposes a language choice without indicating any user preference or opt-in. The surrounding metadata is in Chinese, making the forced language selection more clearly a locale/language policy concern.
This markdown file contains user-facing instructional content exclusively in Chinese and does not mention that language selection is optional. Under the policy rule for language or locale, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown template forces a specific language/locale for all user-facing output. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.
No suspicious patterns detected.
