Security audit
Security checks for vulnerabilities and agentic risk
This is a static London guide with no executable behavior, but users should verify time-sensitive and sensitive advice before relying on it.
This skill is reasonable to install as an informational London guide. Treat prices, visa rules, healthcare details, safety claims, and restaurant dietary status as starting points to verify against current official or venue sources, and avoid relying on the Z-library reference for books.
The invocation description says the skill should be used when a user asks about London "for any purpose," which is extremely broad and lacks boundaries on what kinds of London-related requests are in scope. This can cause unintended activation for casual mentions of London or requests unrelated to the travel/residency guidance described elsewhere in the file.
The statement that most Indian, Pakistani, Turkish, and Middle Eastern restaurants are halal 'by default' can mislead users with strict dietary or religious requirements into assuming compliance without verification. In a city guide focused on practical food advice, users may reasonably rely on this guidance when making dining decisions, and inaccurate assumptions about certification, meat sourcing, or cross-contamination can cause harm or violate religious obligations.
The document prescribes UK-specific institutions, providers, pricing, and advice throughout, starting with a London-specific title and continuing with NHS, UK banks, council tax, and other local services. Under the policy, forcing a specific locale without user opt-in or clear justification can be a natural-language policy violation; this file does not explicitly state that it should only be used for users seeking London guidance.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
| Provider | Network | Typical Plan | Cost |
|----------|---------|--------------|------|
| **SMARTY** | Three | 50GB data, unlimited calls | £8.95/month |
| **Giffgaff** | O2 | 25GB data | £10/month |
| **Voxi** | Vodafone | Unlimited social media | £10–£15/month |
| **Lebara** | Vodafone | 15GB + intl minutes | £5–£10/month |
The summary instructs the agent to begin with a broad reassurance that London is 'very safe for tourists' without qualifying for user-specific factors such as solo travel, late-night activity, disability, gender-based harassment concerns, unfamiliarity with the city, or neighborhood/time-of-day context. This can cause the agent to understate risk and give overconfident safety advice, which is especially problematic in a safety-focused skill where users may rely on concise summaries instead of the nuanced details above.
The guide explicitly recommends Z-library as a money-saving source for books, which is widely associated with unauthorized distribution of copyrighted material. In a student-assistance context, this normalizes potentially illegal access to pirated content and may expose users and the organization to legal, policy, and reputational risk.
The phrase "Tea obligatory" imposes a specific cultural or locale preference as if it is mandatory. Under the policy, forcing a language or locale-specific preference without opt-in can be a natural-language policy issue, even in descriptive content.
No suspicious patterns detected.