Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple pinyin-initialism lookup helper, but users should know it sends lookup text to a third-party API.
Install only if you are comfortable sending abbreviation queries to lab.magiconch.com. Avoid using it with secrets, personal data, or confidential text, and prefer explicit short abbreviation lookups rather than vague prompts.
The trigger phrases are broad enough to activate on common conversational inputs like 'don't understand' or 'what's this', which can cause the skill to run outside its intended niche. In context this is not directly dangerous code execution, but it can lead to unnecessary invocation of the external service and accidental transmission of user-provided text.
The skill instructs sending user input to a third-party API but does not clearly warn that the query leaves the local system. This creates a privacy and consent risk, especially if users paste sensitive text that merely resembles an abbreviation.
The documented behavior performs a POST request to an external domain with user-supplied text, which is an external data transmission path. In this skill's context the transmitted content is usually short abbreviations, so the danger is moderated, but any mis-trigger or careless use could still leak sensitive user content to a third party.
Run curl:
curl -s -X POST "https://lab.magiconch.com/api/nbnhhsh/guess" \
-H "Content-Type: application/json" \
-d '{"text":"abbreviation to query"}'
No suspicious patterns detected.