Security audit
Security checks for vulnerabilities and agentic risk
This is a static Vienna guide with no executable code, install hooks, credential use, persistence, or hidden high-impact behavior.
Reasonable to install as a static Vienna reference. Treat prices, schedules, safety statements, immigration/student requirements, and business facts as starting points to verify against current official sources, and read neighborhood recommendations critically because some wording is subjective and overgeneralized.
Line L011 says the skill should be used when the user asks about Vienna 'for any purpose,' which provides almost no boundary on when it should or should not activate. The description does not include narrower trigger phrases, exclusions, or negative examples, increasing the risk of unintended invocation for general conversation about Vienna.
The phrase 'Established Austrians' classifies suitability around a locale-specific demographic identity and can exclude or alienate immigrants, naturalized residents, or other users without clear necessity. In a city guidance skill, this kind of demographic framing can encode bias into housing advice and steer users based on nationality- or belonging-adjacent assumptions rather than neutral factors.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
d.at — International students
- **Wihast:** wihast.at — Multiple locations
- **Home4Students:** home4students.at
- **STUWO:** stuwo.at
### Finding WG (Shared Flat)
- **WG-gesucht.de** — Main platform
- **Facebook groups** — "WG Wien", student groups
- **willhaben.at** — General listings
- **University notice boards**
### Tips
- Apply for dorms early (3-6 months ahead)
- WG competition fierce — present well
- University first-year housing programs exist
- Semester start = hardest time to find
---
## Student Life
### ÖH (Student Union)
- Mandatory membership (~€21/semester)
- Legal help
- Discounts
- Representation
### Student Discounts
| What | Discount |
|------|----------|
| **Transport** | Semester ticket: €75/6 months |
| **Museums** | Free or reduced (under 19/26) |
| **Opera standing** | €10-18 |
| **Cinema** | Student nights ~€7 |
| **Restaurants** | Mensas €4-8 |
| **Software** | Microsoft, Adobe etc. free/cheap |
### Mensas (Cafeterias)
All univer
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
d.at — International students
- **Wihast:** wihast.at — Multiple locations
- **Home4Students:** home4students.at
- **STUWO:** stuwo.at
### Finding WG (Shared Flat)
- **WG-gesucht.de** — Main platform
- **Facebook groups** — "WG Wien", student groups
- **willhaben.at** — General listings
- **University notice boards**
### Tips
- Apply for dorms early (3-6 months ahead)
- WG competition fierce — present well
- University first-year housing programs exist
- Semester start = hardest time to find
---
## Student Life
### ÖH (Student Union)
- Mandatory membership (~€21/semester)
- Legal help
- Discounts
- Representation
### Student Discounts
| What | Discount |
|------|----------|
| **Transport** | Semester ticket: €75/6 months |
| **Museums** | Free or reduced (under 19/26) |
| **Opera standing** | €10-18 |
| **Cinema** | Student nights ~€7 |
| **Restaurants** | Mensas €4-8 |
| **Software** | Microsoft, Adobe etc. free/cheap |
### Mensas (Cafeterias)
All univer
Line L086 states 'Grüß Gott' is the standard greeting and explicitly contrasts it with 'Hallo,' which can be read as directing the agent toward a specific locale-bound phrasing. Because the skill does not present this as an optional user preference or situational choice, it may impose a language/locale norm without opt-in.
This markdown section promotes wine taverns and alcoholic drinks, including guidance on ordering wine and trying strong seasonal drinks, but provides no caution about alcohol consumption, intoxication, or suitability for some users. Because the file is a markdown skill description, user-affecting behavior involving alcohol should include a basic warning or moderation note.
This markdown guidance repeatedly tells the user to use German phrases such as 'Ich bin Vegetarier/in' and 'Ich bin vegan,' and later notes that phone booking is common and 'German helps.' Under the policy rule, forcing or presuming a specific language without explicitly offering a language choice can be a natural-language policy concern.
Under 'German Phrases,' the skill explicitly directs users toward one language for interaction. The policy allows locale constraints when they are clearly documented and justified, but this section does not offer alternatives or note that the language guidance is optional.
This is a natural-language locale statement in a markdown file that effectively imposes a language requirement. The file does not mention translation support, multilingual options, or that this is a constraint of the external service rather than the skill's own language behavior.
The phrase "English-friendly" frames a language preference as a positive attribute for expats, which can conflict with language/locale neutrality expectations. The file does not offer any user choice or explain a justified need for prioritizing English as a criterion.
The recommendation to 'avoid 10th and 11th' for 'newcomers and expats' is overly broad normative guidance tied to place and population categories without clear, objective criteria. In a relocation/advice skill, this can steer users away from diverse or working-class districts based on generalized safety and quality judgments, reinforcing socioeconomic or ethnic stigma and producing biased decision support.
The recommendations use identity-coded language such as 'quiet Austrian life,' 'Established Austrians,' and 'Avoiding: 17th (unless you specifically want quiet Austrian suburbs),' which implicitly treats Austrian identity as a desirable default and may steer users based on ethnic or national framing rather than neutral housing factors. In a relocation guidance skill, this can normalize exclusionary preferences and produce biased recommendations for users from different backgrounds.
The guide gives broad assurances such as 'walking home alone generally fine' and 'U-Bahn safe at all hours' without clearly stating that safety conditions can change by time, location, or current events, and that official local guidance should take precedence. While not overtly dangerous in context, such phrasing can lead users to overgeneralize and make riskier decisions based on stale or incomplete information.
The emergency and medical sections provide useful operational guidance, but they do not explicitly tell users to contact official emergency services immediately in urgent situations or rely on qualified medical professionals for diagnosis and treatment. In a safety-oriented skill, omission of that disclaimer could delay appropriate action if a user treats the content as sufficient real-time emergency advice.
Line L030 states "German language in B2B," which presents a locale/language expectation as a general constraint. Because the document does not qualify this as context-dependent or offer language-choice guidance, it can be read as enforcing a specific language without user opt-in.
This markdown file contains natural-language guidance, so SQP-3 applies. The statement 'German B2 usually required' presents a locale/language expectation as a general rule without offering user choice or clearly limiting it to German-taught programs, which may be read as a blanket language requirement.
The lodging guide labels specific areas as 'sketchy at night' and 'less safe feeling' without attribution, evidence, or nuance. In a travel skill, this can reinforce bias, mislead users about real safety conditions, and unfairly stigmatize neighborhoods, especially when phrased as blanket guidance rather than sourced, time-bound advice.
The markdown includes prescriptive language such as 'Say "Grüß Gott"' and 'Use Herr/Frau + academic titles if known,' which steers user behavior toward a specific language/locale convention. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this file does not present these as optional alternatives.
No suspicious patterns detected.