Security audit
Security checks for vulnerabilities and agentic risk
This skill performs disclosed travel research and report generation, with no hidden code, credential access, or persistence found.
Install only if you want a Chinese-language travel ranking workflow that may run several web searches and create local Markdown/HTML reports. For casual travel chat, invoke it explicitly only when you want a structured destination comparison.
The trigger phrases are broad, generic travel terms such as '旅行推荐', '去哪里旅游', and 'holiday travel', which can match many ordinary requests not specifically requiring this skill. Over-broad invocation increases the chance the skill runs in unintended contexts, causing unnecessary web research, irrelevant outputs, or incorrect tool selection that may override a more suitable skill.
The skill metadata and content are written to require Chinese-language interaction and outputs, but do not provide a language-selection mechanism or clearly document that the skill is intentionally limited to Chinese-speaking users. This can cause misalignment with user expectations, accidental invocation for non-Chinese requests, and degraded usability or misunderstanding rather than a direct security compromise.
The trigger phrases are very broad, natural-language requests such as general travel recommendation questions, which can cause the skill to activate during ordinary conversation without clear user intent to invoke this specific workflow. That creates a prompt-squatting/overbroad-activation risk: the agent may launch network-heavy data collection and ranking behavior when the user only wanted casual advice, reducing user control and potentially causing unnecessary external lookups.
