Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it says, but its helper script creates and sends a persistent install identifier for attribution without clear user control or opt-out.
Review this skill before installing if you are uncomfortable with affiliate-style tracking. Running the helper script will contact a remote coupon API, persist an anonymous install ID locally, and send that ID with future requests. Treat returned coupon links and QR codes as third-party destinations, and only open or scan them if you trust the coupon provider and the WeChat-based redemption flow.
The README instructs users to run npx skills add moooai/movie-coupon without pinning a specific version of the skills package. This can cause users to execute whatever package version is current at install time, creating a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.
The skill description and later instructions push users toward redeeming via WeChat, but do not clearly disclose this as a platform dependency or offer an alternative flow. This can mislead users, create inaccessible redemption paths for non-WeChat users, and funnel them into a specific external ecosystem without sufficient transparency.
The trigger phrases include broad intents like '我要看电影' and '看电影省钱', which can activate the skill in situations where the user did not explicitly ask to fetch third-party coupon links. Because the skill returns unauthenticated external URLs and QR codes, over-broad routing increases the chance of unsolicited promotion, misrouting, or sending users to external redemption flows without clear intent confirmation.
The documentation instructs users to open unauthenticated third-party coupon links and scan QR codes, but provides no warning about privacy, tracking, redirection, or the risks of interacting with external endpoints. In this skill context, that omission is meaningful because the API response directly surfaces outbound URLs and QR images that users may trust simply because they came from the skill.
The code stores a stable install identifier in a local file and automatically sends it with every API request, even though coupon retrieval does not inherently require persistent cross-session identification. In the context of a simple coupon skill, this expands data collection unnecessarily and allows remote tracking and profiling of individual installations.
The script silently persists a unique identifier to disk and transmits it to a remote service without any user-facing warning, privacy notice, or consent flow. This creates a privacy and transparency issue because users cannot reasonably infer that running a coupon-fetching utility will create long-term tracking state on their machine.
The script's stated purpose is only to fetch coupon information, but it also creates and persists a per-install UUID used for attribution tracking. This is dangerous because it introduces undisclosed device-level tracking behavior beyond the documented functionality, enabling correlation of requests over time without informed user consent.
The README states that API requests automatically append ch / u attribution parameters tied to an anonymous install identifier, but it does not clearly explain what data is transmitted, to whom, and how users can opt out. This is a privacy and transparency issue because users may unknowingly send tracking-related metadata during normal use.
The manifest description is written only in Chinese and provides no indication that users can choose another language or locale. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
The guidance repeatedly tells users to open links in WeChat or scan with WeChat, and the document is entirely presented in Chinese, without indicating that this WeChat-specific flow is optional or region-specific. Under the policy, forcing a specific locale/platform experience without opt-in can be a natural-language policy concern unless clearly justified and documented.
The script’s human-facing description and output strings are entirely in Chinese, including the CLI description and coupon display text, with no option to choose another language. This can violate language or locale policy when a skill imposes a specific language without user opt-in or documented justification.
No suspicious patterns detected.
