Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only MML helper skill with privacy-sensitive examples that users should deploy carefully.
Install is reasonable if you need MML authoring help. Before deploying scenes that use m-position-probe or m-chat-probe, clearly disclose collection to users, limit probe range and retention, avoid exposing raw connection IDs unnecessarily, and handle chat content as user-generated sensitive data.
The position-tracking example explicitly demonstrates collecting user location, rotation, and connection identifiers via m-position-probe without any privacy notice, consent guidance, or data-minimization warning. In a reusable skill, example code often gets copied directly into production, so this omission can normalize silent user tracking in metaverse environments.
The chat-reactive example shows how to receive e.detail.message and connectionId from nearby users without any warning that this is user-generated content and identity-linked telemetry. Because the skill is instructional and copy-paste friendly, it increases the chance of deploying chat monitoring features without transparency, consent, or handling guidance for sensitive content.
This markdown file describes m-position-probe as tracking user positions within range and invoking callbacks on enter, move, and leave events. The description documents the behavior technically but does not include any warning about privacy implications or user-data monitoring, which is required for markdown files describing behaviors that could affect user privacy.
The m-chat-probe section states that it can receive chat messages from nearby users and trigger onchat scripts. This is a privacy-sensitive behavior, but the markdown provides no warning or disclosure about monitoring user communications.
No suspicious patterns detected.
