Security audit
Security checks for vulnerabilities and agentic risk
This Portuguese local-dashboard skill makes disclosed, purpose-aligned public API and search requests for weather, holidays, currency, and air quality, with no code execution, persistence, or credential access.
Before installing, be aware that using the skill can send the requested or default city name to third-party weather, currency, holiday, and search services. If you do not want Goiânia used by default, specify the city explicitly.
The trigger list is broad enough to activate on generic weather or daily-summary requests, which can cause the skill to run when the user did not explicitly intend to use it. In this skill, unintended activation is more concerning because execution causes external requests based on inferred or default location data, creating unnecessary data exposure and confusing behavior.
The skill instructs the agent to send city/location-related queries to multiple third-party services but does not warn the user or obtain consent. Because the skill defaults to Goiânia when no city is provided and also performs fallback web searches, users may unknowingly have inferred location context transmitted to external providers.
The instructions require translating weather and moon-phase descriptions to Portuguese, imposing a specific language regardless of the user's preferences. This is a natural-language policy issue because the skill does not provide any user choice or documented justification for the locale restriction.
No suspicious patterns detected.
