Security audit
Security checks for vulnerabilities and agentic risk
This is a browser-assisted shopping search skill with disclosed local result saving and no evidence of hidden execution or data theft.
Before installing, expect the skill to operate in your logged-in Goofish browser session and to save a Markdown file of search results, including item links, to the desktop path shown in the instructions. Review or adjust the save location if you do not want local records of your searches.
The skill’s stated purpose is search/filter/sort, but it also writes a Markdown file to the local desktop. That is an undeclared side effect affecting the local filesystem, which can surprise users, persist potentially sensitive shopping interests, and violate least-privilege expectations for a search-only skill.
The skill instructs writing search results to /home/k/桌面/... without an explicit warning or consent flow. Silent local persistence can expose private interests, create clutter or overwrite expectations, and is especially risky because the saved file includes direct item links and query-derived filenames.
The output format block is closed at L255, but another closing code fence appears at L259 after plain bullet lines. This contradicts the apparent documentation intent by presenting malformed markdown, so the documented output structure does not accurately match what is shown.
This markdown file presents all instructions, labels, and operational notes exclusively in Chinese. Under the policy rule for language or locale constraints, forcing a single language without opt-in can be a natural-language policy issue when no alternative language option or justification is provided.
No suspicious patterns detected.
