Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed grocery deal watcher that stores a local watchlist and can run user-configured web searches on a schedule, with privacy considerations but no hidden or destructive behavior found.
Install only if you are comfortable storing a local grocery watchlist that may include your home area and shopping preferences, and with scheduled checks sending product and location-based queries to external search/fetch services. Use a coarse location when possible, review or delete `/data/workspace/data/supermarkt-watchlist.json` when no longer needed, and only create the cron job if you actually want recurring checks.
The skill advertises automated nearby deal checking and alerts, but the described implementation mainly stores configuration and provides workflow guidance rather than actual enforced behavior. This mismatch can mislead users about what data is processed, what automation really occurs, and whether notifications or external lookups are actually happening, undermining informed consent and safe deployment decisions.
The skill describes reading and writing a persistent local data file but does not declare any tool scope or permissions boundary. That creates an authorization gap: an agent may use file capabilities without explicit user-visible scoping, which is risky for a skill handling location and shopping-preference data.
The skill stores home location, radius, timezone, and product preferences in a local file, but it does not warn users that this creates a persistent record of potentially sensitive behavioral and location data. In a personal-shopping context, that data can reveal where a user lives and what they regularly buy, increasing privacy risk if the workspace is shared or later accessed by other tools.
The workflow instructs recurring web searches using product names and location-derived queries, but it does not disclose that user-derived location and shopping-interest data will be sent to external search/fetch services. In this context, repeated scheduled lookups can create a persistent external data trail linking a user's approximate location with consumption habits.
No suspicious patterns detected.
