Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its stated activity-query and publishing purpose, but it can upload user images and publish event records to a remote service without a clear final confirmation step.
Review all event fields and image files before use, and require the agent to ask for explicit confirmation before applying upload URLs or calling createActivity. Use a scoped or revocable MJZJ API key where possible.
The skill prescribes a full write workflow for publishing activities to a third-party service but does not require an explicit user confirmation immediately before the irreversible remote write. That creates a meaningful risk of unintended posting if the agent misinterprets user intent or proceeds from partial instructions.
The workflow instructs the agent to download user-provided images and upload them to a third-party storage endpoint via putUrl without warning that files will leave the local/chat context and be transferred to external infrastructure. This can expose personal, proprietary, or sensitive image contents and metadata without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://data.mjzj.com/api/activity/query?status=recording&cityId=&position=" \
-H "Content-Type: application/json"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://data.mjzj.com/api/activity/query?status=recording&cityId=&position=" \
-H "Content-Type: application/json"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://data.mjzj.com/api/activity/query?status=recording&cityId=&position=" \
-H "Content-Type: application/json"
This step initiates an external upload workflow that results in user-supplied files being transferred to third-party storage, but the skill does not pair it with a consent/privacy warning. The risk is not the mere use of an external endpoint, but the undocumented transmission of user content and metadata to a remote upload location.
curl -X POST "https://data.mjzj.com/api/common/applyUploadTempFile" \
-H "Authorization: Bearer $MJZJ_API_KEY" \
-H "Content-Type: application/json" \
-d '{
This endpoint performs a remote write that publishes activity data using an authenticated API, yet the skill lacks a required final confirmation checkpoint. In practice, that increases the chance of accidental or premature publication of user-provided event details.
curl -X POST "https://data.mjzj.com/api/activity/createActivity" \
-H "Authorization: Bearer $MJZJ_API_KEY" \
-H "Content-Type: application/json" \
-d '{
No suspicious patterns detected.