Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Immowelt property-search helper that makes public web requests and does not show hidden, persistent, credential, or destructive behavior.
Install this only if you want Codex to run a local Python helper that queries Immowelt pages. Confirm intent before using it on broad real-estate questions, and use reasonable request limits because it scrapes public listing pages.
The skill performs network-backed data retrieval via a Python script, but the manifest does not declare any explicit tool scope or allowed permissions. This creates an authorization and transparency gap: users or orchestrators cannot easily constrain or reason about the skill's external access, increasing the chance of unintended network use or abuse if the skill is invoked in sensitive contexts.
The trigger phrases are broad and include generic terms such as 'Austrian real estate', 'German real estate', 'Wohnung kaufen', and 'Haus kaufen', which can cause the skill to activate in many unrelated conversations about property markets. Unintended invocation can lead to unnecessary network requests, data retrieval, and agent behavior that the user did not explicitly request.
No suspicious patterns detected.
