Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward livestream shopping note tool that stores user-entered shopping notes locally for later summaries.
Install this if you are comfortable with a livestream shopping notes tool saving product notes, links, prices, and preferences locally for later review. Avoid entering sensitive personal or financial information unless you know how the host environment manages LocalStore retention and deletion.
The file title and multiple user-facing strings are presented only in Chinese, and the example interaction text also assumes Chinese input. This creates a natural-language locale constraint without any indication that users can choose another language or that the skill is intentionally limited to a specific region or audience.
The skill persistently stores livestream session notes, item details, links, and preferences via LocalStore without any visible consent, retention control, or disclosure to the user. Because shopping notes can reveal behavioral preferences, purchase intent, and possibly sensitive free-text notes, silent persistence creates a privacy risk if the data is later accessed by other components or retained longer than expected.
The file presents core invocation examples and most user-facing instructions in Chinese, but does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing or assuming a specific language without opt-in can be a natural-language policy issue.
