Security audit
Security checks for vulnerabilities and agentic risk
This skill is a transparent China grocery price-comparison helper and does not show hidden execution, credential use, ordering, persistence, or data exfiltration behavior.
Install this if you want help comparing public grocery prices for mainland China platforms. Do not use it for private account pricing or checkout automation; the artifact itself says to stop before login, coupon claiming, payment, or ordering.
The skill strongly mandates a Chinese-language persona and preferred phrasing without indicating that the assistant should adapt to the user's requested language. This can override user preference, reduce accessibility, and create a prompt-quality/safety issue where the agent follows skill style constraints over the user's explicit communication needs.
The default prompt begins with 'Use $maicai' and then specifies all instructions in English, while the display name and short description are in Chinese and the skill targets mainland China grocery platforms. This creates a natural-language locale inconsistency and effectively imposes a language choice without documenting user opt-in or offering alternatives.
The rules prescribe exact Chinese fallback phrases, which can override user language preference and cause the agent to respond in Chinese without opt-in. This is primarily a prompt-quality and user-control issue rather than a direct security exploit, but it can degrade trust, accessibility, and policy compliance in multilingual contexts.
The natural-language description forces a single language presentation but does not state that the skill is China- or Chinese-language-only, nor does it offer any user opt-in or language choice. Under the policy, a fixed language without documented justification or choice is a locale/language policy concern.
The reference is written as if the applicable platforms and pricing context are fixed, including Chinese platform names and a tie-breaker mentioning saving 'a few yuan'. This can be a language/locale policy concern because it assumes a specific regional market context without stating that the skill is China-specific or giving the user an opt-in choice.
No suspicious patterns detected.
