Security audit
Security checks for vulnerabilities and agentic risk
This skill is a China-focused grocery price comparison helper with some incomplete advertised features, but I found no hidden access, persistence, credential handling, or destructive behavior.
Installers should treat this as a local, mock-data grocery comparison helper unless live querying is added later. Review carefully before relying on the advertised price alerts, screenshot/OCR handling, or live platform scraping claims, because those capabilities are documented but not actually implemented in the inspected script.
The manifest describes the skill around China-specific platforms and the example invocation is only in Chinese, which implies a fixed language/locale experience. There is no natural-language indication that users may choose another language or that the Chinese-only constraint is an explicit, justified regional policy.
This JSON file uses Chinese-only keyword lists for category classification, which creates a natural-language locale constraint in the skill behavior. Because the file provides no indication that the skill is intentionally China/Chinese-market specific, it may violate the policy against silently forcing a specific language or locale.
This JSON embeds platform names and coverage cities in Chinese only, and later defines Chinese measurement units such as 斤 and 公斤. Because the file provides no indication that the skill is China-specific or that users can choose locale/language, it may violate a language/locale policy requiring user opt-in or documented regional justification.
The only example shopping list is written in Chinese, and other fields reference CNY and city context, which together suggest the skill expects a specific language/locale. Because the schema does not indicate that other languages are accepted or that Chinese input is optional, this can be read as a locale-specific constraint without explicit opt-in or justification.
This code file contains user-facing natural language that assumes Chinese input and examples, such as the shopping-list format shown in the docstring. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is explicitly justified.
Line L585 tells users that "Price alerts" are available and suggests a --alert setup flow, but the argument parser defines no --alert option and the code implements no alerting behavior. This is an active contradiction between user-facing intent/documentation text and actual functionality.
No suspicious patterns detected.
