Security audit
Security checks for vulnerabilities and agentic risk
This skill only gives instructions for opening disclosed 易企收 demo or login pages in a visible browser, with no code, persistence, credential collection, or hidden behavior.
Install only if you want an agent to open 易企收 demo or login pages for you. Because the triggers are broad and the site is payment-related, review the destination before entering credentials or business data, and ask the agent for confirmation when your request is informational only.
The skill registers on broad natural-language phrases such as '打开易企收', '管理缴费信息', and '了解缴费功能', which can overlap with ordinary user discussion and cause unintended invocation. Because the skill can automatically open external banking/payment-related pages, accidental triggering may launch browser actions without sufficiently specific user intent.
The keyword-based intent rule treats vague words like '了解', '查看', or '演示' as sufficient to decide navigation behavior, but it lacks boundaries, exclusions, or confidence thresholds. This can misclassify conversational requests and automatically send users to demo or production-related pages, increasing the chance of unwanted external actions in a sensitive payment context.
The workflow directs the agent to automatically open official or demo URLs based on inferred intent, but it does not require a clear notice or user confirmation before launching the browser. While the destinations appear legitimate, silent navigation can still surprise users, create privacy concerns, and make accidental interaction with production login pages more likely.
No suspicious patterns detected.
