Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward research API skill with disclosed external calls and no local code execution, though users should avoid sending sensitive queries unless they trust the kenkyu service.
Install only if you are comfortable sending research prompts to kenkyu.dev with your token and potentially spending account balance on runs. Avoid using it for secrets, confidential business material, personal data, or sensitive topics unless you have reviewed and trust the provider's data handling.
The skill description says to use it for 'any question that benefits from a thorough, sourced investigation,' which is broad enough to trigger on many general prompts without clearly signaling that user queries will be sent to a third-party service. This increases the chance of accidental invocation on sensitive topics and unintended transmission of user data to an external API.
The markdown describes token-authenticated POST requests to an external API but does not warn that user queries, and potentially sensitive research topics, will be transmitted off-platform. Without an explicit warning or consent cue, users or calling agents may unknowingly send confidential information to a third party, creating privacy and data-handling risk.
No suspicious patterns detected.
