Security audit
Security checks for vulnerabilities and agentic risk
This skill performs the traffic-fine lookup it claims to do, but users should know it sends plate data to a third-party intermediary site.
Install only if you are comfortable sending license plate details, and any phone number you provide, to vnetraffic.org, which the skill itself identifies as a non-official intermediary. Use official Vietnamese government or registration portals for final confirmation.
The skill instructs use of a networked script and external endpoint (vnetraffic.org) but does not declare any explicit tool scope or permissions in the skill metadata. This creates an authorization and review gap: a runtime may permit undeclared outbound network access, making data exfiltration, unexpected third-party calls, or privacy-impacting requests harder to audit and constrain.
The script transmits a vehicle plate number and optional phone number to a third-party endpoint (vnetraffic.org) without any explicit user disclosure, consent prompt, or minimization safeguards. License plates and phone numbers are sensitive personal data in context, and the default behavior of sending a fabricated fallback phone number further obscures what data is being submitted and may violate user expectations or privacy requirements.
No suspicious patterns detected.
