Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward guide for querying an AI news API, with expected use of a user-provided RapidAPI key and no hidden execution or persistence behavior.
Before installing, be aware that this skill sends requests to a third-party RapidAPI service and uses your RapidAPI key. Store the key securely, avoid pasting it into shared chats or logs, and use the skill when you specifically want AI news from this feed rather than general AI strategy advice.
The manifest description says to use the skill when the user asks about 'AI news, trending AI topics, what's happening in AI/ML, or wants to build news-powered features.' Several of these triggers are broad and lack exclusion conditions, which can cause the skill to activate for general brainstorming or analysis requests that are not specifically about querying this API.
The skill instructs users to provide and transmit their RapidAPI key in outbound requests to a third-party service, but it does not clearly warn that the key is a secret, that requests leave the local environment, or that the key must never be exposed in prompts, logs, or shared outputs. In an agent setting, this can lead to inadvertent credential disclosure or unsafe handling of user secrets when interacting with external services.
The example Post object shows summary and description in Chinese, while the surrounding schema does not clearly indicate that this locale was explicitly user-selected in the example. Since language/locale policy violations apply to all file types, this can suggest a forced language output pattern unless the user has opted in.
No suspicious patterns detected.
