Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed Yandex Direct campaign-analysis helper, with a minor risk that broad trigger words could cause unnecessary account-data access.
Install this only if you intend to analyze Yandex Direct campaigns and are comfortable providing YANDEX_TOKEN and CLIENT_LOGIN for that purpose. Prefer explicit prompts like asking to analyze Yandex Direct campaign statistics, and avoid invoking it during casual advertising discussion.
All user-facing descriptive and operational language in the skill is written only in Russian, and there is no indication that the user can choose another language or locale. This creates a language policy concern because the skill appears to enforce a specific language experience without explicit opt-in or documented regional limitation.
The trigger phrases are generic enough to activate on broad, ordinary discussion about advertising, which can cause the skill to run outside the user's clear intent. Because the skill is designed to use YANDEX_TOKEN and CLIENT_LOGIN to retrieve campaign statistics, overbroad activation increases the chance of unnecessary access to sensitive advertising data or unintended external API use.
No suspicious patterns detected.
