Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Vipshop shopping assistant that can automate browsing and cart preparation but explicitly leaves payment and final order submission to the user.
Before installing, understand that this skill may use browser automation on Vipshop with your logged-in session to view cart details, apply coupons, select or confirm delivery information, and prepare an order preview. Keep payment and final order submission manual, review the cart/address/price yourself, and ask the agent to stay in manual guidance mode if you do not want account-based browser automation.
The primary skill description is written as an unconditional Chinese-language instruction and does not indicate that users may choose another language. Under the policy, language constraints must be opt-in or clearly justified as region-specific; neither is stated here.
The description specifies usage triggers entirely around Chinese shopping phrases and the rest of the skill heavily prescribes Chinese-language interaction patterns. There is no statement that the skill is China-specific by policy or that users may choose another language, which creates a natural-language locale policy concern.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- ❌ Recommend items with no stock
- ❌ Store user data persistently
- ❌ **Execute payment or final order submission**
- ❌ Guarantee inventory without checking
The natural-language description is entirely in Chinese and presents the skill as a Chinese shopping assistant without offering any language or locale choice. This can violate language/locale policy when a skill implicitly constrains interaction to a specific language absent user opt-in or documented regional justification.
No suspicious patterns detected.