Security audit
Security checks for vulnerabilities and agentic risk
This Yelp skill is a disclosed, purpose-aligned helper for Yelp searches, review analysis, and listing audits, with no evidence of hidden or destructive behavior.
Before installing, be comfortable with Yelp receiving the search terms, location hints, phone numbers, and filters you ask the agent to use. Also expect local notes under ~/yelp/ unless you decline that setup.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -H "Authorization: Bearer ${YELP_API_KEY}" \
"https://api.yelp.com/v3/businesses/search?location=New%20York&term=coffee" \
| jq '.businesses[0] | {id, alias, name, rating, review_count}'
The file says to activate for 'Yelp-specific business search, review analysis, and local comparison requests,' but it does not define exclusions or negative examples for when similar local-search tasks should not invoke this skill. That broad scope can cause unintended activation for ordinary local recommendation or comparison requests that only loosely relate to Yelp.
No suspicious patterns detected.