Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward DomainRank website-submission helper with disclosed external API use and no hidden code or persistence.
Before installing, confirm you intend to submit sites specifically to DomainRank.app. Use an environment variable for the API key, review the site list and pricePlan before any request, and be aware that website URLs and metadata will be sent to DomainRank and may consume account credits.
The description lists triggers such as "提交网站", "submit site", and "AI 导航" without narrowing context or exclusion conditions. These phrases are broad enough to match ordinary requests about website submission or AI directories, which could cause unintended invocation outside a clearly scoped DomainRank-specific action.
The skill content and invocation guidance are entirely presented in Chinese, while also including English trigger phrases, but there is no statement that use of Chinese is optional or region-specific. Under the language/locale policy criterion, this can be read as a fixed language choice without explicit user opt-in or justification.
This skill explicitly transmits user-supplied website data and a bearer-authenticated request to an external third-party service. External transmission is expected for the skill's purpose, but it still creates a real security/privacy boundary: users may not realize their submitted URLs and associated metadata are being sent off-platform, and the API key grants billable actions against the user's DomainRank account.
curl -X POST https://domainrank.app/api/submit-item \
-H "Authorization: Bearer <YOUR_DOMAINRANK_API_KEY>" \
-H "Content-Type: application/json" \
-d '{
The batch submission flow sends multiple outbound authenticated requests in a loop, which amplifies the risk of unintended third-party data transfer and unauthorized credit consumption. Although the text says confirmation is required, a mistaken or overly broad invocation could still trigger repeated spend and repeated disclosure of multiple sites to an external service.
for site in "Site1|https://site1.com" "Site2|https://site2.com"; do
name="${site%|*}"
link="${site#*|}"
curl -X POST https://domainrank.app/api/submit-item \
-H "Authorization: Bearer <YOUR_DOMAINRANK_API_KEY>" \
-H "Content-Type: application/json" \
-d "{\"name\": \"$name\", \"link\": \"$link\", \"pricePlan\": \"basic\"}"
No suspicious patterns detected.