Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only Tokopedia shopping assistant skill with no executable code, persistence, credential handling, or hidden behavior in the reviewed artifacts.
Before installing, understand that this skill is meant to guide an agent using Tokopedia MCP tools for product research and recommendations. Review any separate Tokopedia MCP server you connect it to, since this bundle does not include or audit that server implementation.
Because this is a markdown skill file, vague-trigger rules apply. The phrases 'universal shopping tasks' and 'general Tokopedia workflows' are very broad and do not define clear activation boundaries, increasing the chance the skill is invoked for common shopping-related requests without clear scope limits or exclusion conditions.
This plain-text file includes a template phrased as a general shopping request: 'Find [product type] on Tokopedia with budget up to [max budget].' As an activation or invocation example, it is broad and lacks scope constraints or negative examples, which could overlap with ordinary user requests and lead to unintended invocation.
The tags include "indonesia," which suggests a locale-specific constraint, but the notes do not explain whether this skill is intended only for Indonesian users or content. Organizational locale policies require such constraints to be explicit and justified unless users are given a choice.
No suspicious patterns detected.
