Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public gold, silver, brand, and related futures prices from a disclosed quote API without persistence, credential use, or hidden behavior.
Install this if you are comfortable with the skill contacting api-gold.aibuy.cloud for live quote data. Treat the prices as third-party market data, and be aware that it may answer in Chinese by default and includes one copper futures quote alongside precious-metals data.
The skill invokes a bundled Python script that fetches real-time quotes from an external source, which implies network access, but the manifest does not declare any tool scope or permissions. This creates a transparency and policy-enforcement gap: an agent or reviewer cannot easily determine that external connectivity is required, and a broader runtime may permit undeclared outbound requests.
The instruction 'Summarize in plain Chinese unless the user asks for raw data only' imposes a default language choice rather than letting the user choose their preferred language. This is a natural-language policy concern because it forces a locale/language behavior without explicit opt-in or an offered alternative.
The manifest describes a gold/silver price lookup and precious-metals market brief, with examples limited to gold, silver, and precious-metals futures. Including 沪铜 (copper) adds a commodity outside that stated purpose, which is not justified by the described skill scope.
No suspicious patterns detected.
