Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly purpose-aligned, but it can automatically record and send shipowner demand data through a service that does not define its own access controls.
Install only if you intend this skill to record cargo-search demand data. Deploy the FastAPI service behind authentication or an internal gateway, restrict API_BASE_URL and CARGO_DEMAND_API_PATH, protect ADMIN_API_KEY or ADMIN_TOKEN, and monitor or clear the local demand_outbox.jsonl if backend sync is disabled or failing.
The skill invokes local Python scripts, exposes a network service, references environment configuration, and explicitly allows local file writes via a fallback queue, yet it declares no permissions. This creates a capability/permission mismatch that can mislead operators and security tooling, reducing visibility into network, filesystem, and environment access that the skill actually requires.
The code automatically builds and transmits a demand record containing user-supplied user_id, current port, destination port, capacity, and inferred trade type whenever a search completes, unless an internal flag is disabled. There is no consent check, disclosure, minimization, or visible control in this file, so potentially sensitive commercial voyage-intent data is sent to another component by default, creating a privacy and data-governance risk if users do not expect that sharing.
