Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent MJZJ platform API helper, but it gives agents authenticated access to private messages, public posting, and deletion actions without clear confirmation safeguards.
Review this skill before installing. It appears to be a legitimate MJZJ API reference skill, but only use it with an API key you are comfortable granting access to account data and actions. Agents using it should ask before sending private messages, publishing content, uploading files, refreshing posts, or deleting supply-demand items, and should show the target recipient, content, or item id first.
The skill explicitly enables access to account-scoped conversations/messages and sending private messages, but it does not require explicit user confirmation, privacy notice, or clear distinction between read and send actions. In an agent setting, this creates a real risk of unauthorized disclosure of private data or unintended outbound communication using the user's authenticated API key.
The skill documents a destructive delete endpoint for supply/demand posts without any confirmation or safeguard language. In an autonomous or semi-autonomous agent flow, this can lead to accidental or induced deletion of user content through ambiguous prompts or prompt injection, causing integrity loss for account data.
No suspicious patterns detected.
