Security audit
Security checks across malware telemetry and agentic risk
This skill is mostly purpose-aligned, but it asks agents to store account tokens insecurely, self-update from GitHub, and run broad message-reading and message-sending workflows.
Review before installing. Use this only if you are comfortable giving the skill access to QuestMeet account actions, profile/impression creation, search results, and broad message workflows. Do not store the access token in general agent memory or plaintext workspace files; use a secure secret store if available. Disable or tightly constrain recurring tasks, and require confirmation before sending messages, inviting people, quitting spaces, deleting impressions, or reinstalling the skill.
1. Tell your AI agent to download and install the Opportunity Skill from https://github.com/QuestMeet/opportunityskill 2. Tell your agent your email address. The agent calls the send_code_to_email function to send a verification code to your email. 3. Provide the verification code. The agent calls the sign_in_or_sign_up function to obtain a new access token along with the user's representation. 4. Once the agent has the access token, it should persist it in its long-term memory or a local config file under a distinct key name alongside the user's email address. 5. If there is a profile named "Default User", this indicates that the user has just registered. In this case, the agent updates the profile. ## Processes
A["Call the send_code_to_email function to send a verification code to the user's email"]
A --> B["Ask the user for the verification code"]
B --> C["Once you have the code, call the sign_in_or_sign_up function to obtain a new access token along with the user's representation"]
C --> D["Once you have the access token, persist it in your long-term memory or a local config file under a distinct key name alongside the user's email address"]
D --> E{"Is there a default profile?"}
E -->|"Yes"| F["Update the profile"]
E -->|"No"| G["Authentication completed"]If there is a profile named "Default User", this indicates that the user has just registered. In this case, update the profile, referencing the profile management process and guideline. The access token must be persisted to avoid repeated sign-ins. You must persist the access token in your long-term memory or a local config file as soon as you receive it. Repeatedly asking the user for the verification code leads to a poor user experience. For security reasons, exclude the access token from any messages to anyone.
If there is a profile named "Default User", this indicates that the user has just registered. In this case, update the profile, referencing the profile management process and guideline. The access token must be persisted to avoid repeated sign-ins. You must persist the access token in your long-term memory or a local config file as soon as you receive it. Repeatedly asking the user for the verification code leads to a poor user experience. For security reasons, exclude the access token from any messages to anyone.
1. Call the send_code_to_email function to send a verification code to the user's email. 2. Ask the user for the verification code. 3. Once you have the code, call the sign_in_or_sign_up function to obtain a new access token along with the user's representation. 4. Once you have the access token, persist it in your long-term memory or a local config file under a distinct key name alongside the user's email address. 5. If there is a profile named "Default User", this indicates that the user has just registered. In this case, update the profile, referencing the profile management process and guideline. ### Guideline: authentication
5. If there is a profile named "Default User", this indicates that the user has just registered. In this case, update the profile, referencing the profile management process and guideline. ### Guideline: authentication - The access token must be persisted to avoid repeated sign-ins. You must persist the access token in your long-term memory or a local config file as soon as you receive it. Repeatedly asking the user for the verification code leads to a poor user experience. - For security reasons, exclude the access token from any messages to anyone. ## User Representation
5. If there is a profile named "Default User", this indicates that the user has just registered. In this case, update the profile, referencing the profile management process and guideline. ### Guideline: authentication - The access token must be persisted to avoid repeated sign-ins. You must persist the access token in your long-term memory or a local config file as soon as you receive it. Repeatedly asking the user for the verification code leads to a poor user experience. - For security reasons, exclude the access token from any messages to anyone. ## User Representation
- dict: A dictionary containing email, subscription_plan, monthly_quota, extra_quota, contact_cost, badges, profiles, and impressions ### Process: user representation 1. Find the access token in your memory or the working directory. 2. Call the read_user_repr function. ### Guideline: user representation
- dict: A dictionary containing profile_id, name, avatar, and description ### Process: impression management 1. Find the access token in your memory or the working directory. 2. Distil the user's attributes or preferences from the requests and responses in the current context into 1 to 20 impressions of the user as a buyer or professional. For each impression, also provide 1 to 5 tags representing its topic, points, or keywords/keyphrases. Each tag denotes an entity or a concept. 3. Call the create_impressions function with the appropriate perspective according to the user's purpose. 4. Evaluate whether there is any logical conflict between the earlier impressions and the recent ones, or whether any earlier ones have become obsolete (because people change over time). If so, call the delete_impressions function to delete the earlier ones.
- list: An empty list if no professionals are found ### Process: human discovery 1. Find the access token in your memory or the working directory. 2. Based on the user's requirements, compose 1 to 5 queries to semantically match buyers or professionals. 3. Call the search_buyers or search_professionals function as appropriate. 4. Once you have the search results, select the profiles that meet the requirements to a reasonable extent, introduce each profile you recommend together with its human card ID, and write them to a file; otherwise, explain why no profile meets the requirements.
# Opportunity Skill - In this Skill, "you" refers to the AI agent reading it, not a human user. - The current version is v1.7, updated on 2026-08-12 at 12:30. We update this Skill at most once every 72 hours to optimise its functionality. If more than 72 hours have passed since this update, check https://github.com/QuestMeet/opportunityskill for the latest version. If the current version is not the latest, remove this Skill locally and install the latest version. - This Skill has 16 callable functions defined in scripts/callable_functions.py, which send requests exclusively to https://questmeet.ai/graphql with trust_env=False. The functions are powered by QuestMeet, an opportunity network for AI-native professionals and buyers. - The functions, along with processes and guidelines for calling them, are organised into 6 modules: authentication, user representation, human card management, human discovery, human outreach, and lead engagement. - For a better user experience, the access token obtained through the authentication process must be persisted in your long-term memory or a local config file. If you cannot find the access token, switch to the authentication process to obtain a new one and rerun the current process. If any function returns None, the access token is invalid or has expired. In this case, switch to the authentication process to replace it with a new one and rerun the current process.
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.