Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent commerce integration, but it can submit paid quotes and place high-value orders without enough built-in confirmation or data-disclosure guidance.
Review this before installing because it can interact with an external commerce service and place high-value orders. Use it only where agents are required to show price, quantity, destination, and total cost and receive explicit user approval before creating quotes or placing orders.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl "https://sputnikx.xyz/api/feed/products.json"
The skill documents quote creation and order placement without an explicit warning that these are transactional operations and that user-supplied delivery information will be sent to an external service. In an agent setting, this increases the risk of unintended purchases, surprise charges, or disclosure of personal/business delivery data if the assistant invokes these actions without sufficiently clear user confirmation.
The skill is marked user-invocable and described only by broad commerce actions like searching products, checking prices, creating quotes, and placing orders. The file does not define specific trigger phrases, scope limits, or exclusion conditions, which can make activation boundaries unclear in systems that infer invocation from descriptions.
No suspicious patterns detected.