Security audit
Security checks for vulnerabilities and agentic risk
This is a prompt-only return-planning checklist skill with disclosed limits and no code, network, credential, or account access.
Before installing, understand that the skill may ask for shopping and return details such as order numbers, labels, receipts, and item locations. Provide only what is needed, redact unnecessary personal data, and independently verify store policies and deadlines before acting.
The acceptance criteria state 'No CJK characters. Documentation is English/ASCII only' and the manifest metadata is constrained to language=en. This is a natural-language locale policy constraint, and the file does not offer any user choice or explain a region-specific reason for forcing English-only behavior.
The trigger phrases are broad, everyday requests such as 'plan my returns' and 'organize my returns', which can cause the skill to activate unintentionally in general conversation. This is mainly a safety and UX issue rather than a direct security exploit, but unintended activation can surface private shopping or logistics details in the wrong context.
The manifest sets "language": "en" with no indication that users may opt into another language or that the skill is intentionally limited to English for a documented reason. This can conflict with language/locale policy expectations requiring user choice or explicit justification.
No suspicious patterns detected.
