Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrow apartment-rental search helper that browses listed real-estate sites and returns matching Odessa listings, with no evidence of credential access, persistence, destructive behavior, or hidden execution.
Before installing, understand that this skill may browse multiple public real-estate sites when rental-related Russian trigger phrases are used. It is best suited for the fixed Odessa 2-room rental criteria shown in the skill; users who need other cities, budgets, languages, or explicit confirmation before browsing should adjust the skill first.
The skill description, triggers, workflow, and response template are all specified in Russian and do not indicate that the user may choose another language. This can violate language/locale policy when a fixed language is imposed without opt-in.
The skill does not clearly define when it should and should not run, so ordinary apartment-rental discussion may unintentionally invoke it. Because the skill is configured to browse multiple third-party sites and collect listings, ambiguous activation increases the chance of unintended autonomous web actions.
The trigger phrases are broad conversational phrases like 'найди квартиру' and 'что по аренде', which can easily match ordinary user requests outside a narrowly scoped invocation. This can cause the skill to activate unexpectedly and launch third-party browsing behavior without the user clearly intending to use this specific Odessa rental workflow.
The workflow instructs the agent to browse several external real-estate sites and gather listing data, but it does not warn the user that third-party browsing will occur. This reduces transparency and informed consent, especially if browsing reveals user interest patterns or causes external requests the user did not expect.
No suspicious patterns detected.
