Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent ZoomEye API integration for asset search, with expected external queries and API-key use, but users should treat searches as third-party reconnaissance activity.
Install this only if you intend to use ZoomEye for authorized asset discovery or threat-intelligence work. Searches, target identifiers, and related parameters may be sent to ZoomEye along with your API key, so avoid submitting secrets, private internal details, or third-party targets you are not authorized to investigate.
The skill requires environment secrets and performs external network queries, but it does not declare an explicit tool scope such as allowed-tools or permissions. This weakens runtime containment and makes it easier for the skill to access sensitive capabilities without clear, reviewable authorization boundaries.
The skill description explains what analysis it performs but does not clearly warn users that their queries will be sent to an external third-party service and that API-backed network lookups will occur. This can expose sensitive search terms, target identifiers, or investigative context to ZoomEye without adequate transparency or informed consent.
The trigger conditions are described broadly as applying whenever a user needs asset discovery, security assessment, mapping, or threat intelligence analysis. Overly broad activation criteria can cause the agent to invoke this skill in situations where the user did not intend external reconnaissance or data disclosure, increasing the risk of unauthorized or surprising network searches.
This reference file provides concrete reconnaissance and vulnerability-discovery queries for exposed databases, admin portals, risky configurations, specific enterprise products, and IoT devices, but it includes no accompanying guidance on authorization, lawful use, privacy, or operational safety. In a security-search integration skill, such examples materially lower the barrier to dual-use scanning and targeting, especially because they are framed as ready-to-use workflows for asset and vulnerability discovery.
The script sends user-provided search queries directly to the external ZoomEye service, which can disclose sensitive internal terms, IPs, domains, or investigative targets to a third party. In this skill’s context, that behavior is core functionality rather than obviously malicious, but the lack of any user-facing warning, consent gate, or sensitivity check creates a real privacy and operational security risk.
The natural-language documentation and all user-facing messages in the script are written only in Chinese, with no indication that users may choose another language. Under the policy, a fixed language choice without opt-in can be a locale/language policy violation unless clearly justified as region-specific.
No suspicious patterns detected.
