Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a disclosed Chinese calendar, fortune, and naming service with user-confirmed PayPal payments, not a hidden or persistent local security threat.
Before installing, expect this skill to use Traditional Chinese, contact sinodata.io, and ask for PayPal payment before paid fortune, I Ching, or full naming reports. Avoid entering birth dates or naming details unless you are comfortable sharing them with that service.
The skill description defines very broad triggers such as astrology, naming, auspicious dates, and fortune questions without clear invocation boundaries. This can cause the agent to auto-invoke a paid external skill for ordinary user queries, increasing the chance of unnecessary data disclosure and unintended payment prompts or transactions.
The skill mandates that all output be in Traditional Chinese regardless of user preference and requires the agent to transform API output before responding. While not directly a code-execution issue, this overrides normal user-choice and can degrade transparency, accuracy, and consent, especially if users requested another language or if conversion changes meaning in sensitive fortune or naming content.
The content is entirely written in Chinese and encodes Chinese-specific naming conventions, fortune labels, and character stroke rules, but the file provides no indication that this locale restriction is optional or intentionally scoped to Chinese-language users. Under the language/locale policy rule, a skill that forces one language or locale context without user choice or documented justification can be a policy concern.
The manifest presents the skill primarily in Traditional Chinese and strongly centers Chinese-language trigger terms, while not stating that the skill is region- or language-specific by design. Because the policy requires avoiding forced language or locale constraints unless the user opts in or the restriction is clearly justified, this is a natural-language policy concern.
The trigger list contains broad terms such as "運勢", "五行", "命理", "卦", and English phrases like "fortune" that can match ordinary conversation and unrelated cultural, literary, or educational queries. In a paid skill, overbroad activation is dangerous because it can cause unintended invocation, misroute user intent, and increase the risk of accidental paid calls or unnecessary data disclosure to the external API.
This JSON manifest-like data uses Chinese-only natural-language descriptions and values throughout, but does not document that the skill is China/Chinese-locale-specific or offer any user language choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This JSON dataset uses Chinese-only names, descriptions, and content throughout, which can effectively force a specific language/locale on downstream use. The file does not document that it is intentionally region- or language-specific, nor does it offer any user choice or fallback.
This manifest-style JSON file contains user-facing natural-language values almost entirely in Chinese, including zodiac names, traits, and compatibility text. Under the language/locale policy, forcing a specific language without opt-in or documented regional scope can be a policy concern.
