Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward MBTI quiz skill that uses JisuAPI as disclosed, with the main privacy consideration that quiz answers are sent to that third-party API.
Install only if you are comfortable using JisuAPI for MBTI scoring. Your API key is read from JISU_API_KEY, and quiz answers or answer codes are sent to JisuAPI to produce the result; avoid using it for highly sensitive personal assessments unless that third-party handling is acceptable.
The skill declares runtime requirements including an environment variable and relies on an external API, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates a governance gap: an agent may invoke code with network access and secret handling without clear policy boundaries, increasing the chance of over-broad execution or unintended secret exposure.
The activation guidance is broad enough that the skill may trigger on generic personality-test or MBTI-related requests without clearly confirming the user's intent to use this third-party-backed workflow. Mis-triggering can unnecessarily route user interaction and responses into this skill, which matters more here because answers are later sent to an external service.
The skill collects questionnaire answers and submits them to a third-party API but does not prominently warn users that their responses will leave the local system. Personality-test answers can reveal sensitive personal traits or preferences, so the lack of transparent disclosure undermines informed consent and creates privacy risk.
This skill sends user test interactions to a third-party API endpoint, which is an external transmission of potentially sensitive personality-assessment data. While HTTPS is used and this is necessary for the skill’s functionality, users may not expect their answers and derived personality data to be shared with an external service, creating privacy and data-handling risk.
import requests
QUESTIONS_URL = "https://api.jisuapi.com/character/questions"
ANSWER_URL = "https://api.jisuapi.com/character/answer"
The answer submission endpoint transmits the compiled MBTI answer string to an external service, directly exposing user-provided assessment responses and enabling third-party profiling. In the context of a personality-test skill, this is more sensitive than a generic lookup because the data can reveal inferred traits and preferences.
QUESTIONS_URL = "https://api.jisuapi.com/character/questions"
ANSWER_URL = "https://api.jisuapi.com/character/answer"
def _normalize_version(version: Any) -> str:
The interactive quiz prompts and validation messages are hard-coded in Chinese, requiring users to interact in a specific language. The file does not offer a language choice or document that the skill is intentionally limited to Chinese-speaking users.
No suspicious patterns detected.