Security audit
Security checks for vulnerabilities and agentic risk
This is a lightweight offline conversion helper with no executable code or requested system access, though its static rates and IST time default can be misleading for real-world decisions.
Install only for casual offline estimates. Verify live currency and crypto prices before banking, trading, or purchasing decisions, and explicitly provide the timezone for scheduling or deadline questions because the skill defaults to IST/Ahmedabad and contains stale March 2026 reference assumptions.
The phrase "Use this skill anytime for instant, no-internet conversions" is an overly broad invocation cue in a markdown skill description. It does not clearly limit when the skill should or should not activate, which could cause unintended invocation during ordinary chat involving numbers or time references.
The listed trigger phrases include highly abstract templates like "convert X Y to Z" and "how many Z in X," which are not specific enough to the domain and lack boundaries or negative examples. Such patterns can collide with common everyday speech and make activation criteria ambiguous.
Defaulting to IST/Ahmedabad without user opt-in can cause the agent to give incorrect time calculations when the user is in another locale or expects local time. While not a traditional exploit vector, it can materially mislead users about schedules, deadlines, or event timing, especially because the skill presents the locale assumption as a default operational behavior.
No suspicious patterns detected.
