Security audit
Security checks for vulnerabilities and agentic risk
This review-network skill is mostly coherent, but it mixes ordinary review features with operator moderation actions and under-specified handling of location-linked review data.
Install only if you are comfortable sending venue names, coordinates, ratings, review text, votes, and flags to AgentReviews. Keep operator alert tokens out of normal user environments, ask before using GPS or retry-storing failed reviews, and treat the operator moderation sections as admin-only documentation.
The skill documents operator-only alert triage and internal moderation capabilities even though it is presented as a user-facing review skill. Including operational security workflows in a broadly invocable skill creates a privilege-boundary risk: an agent or integrator may expose or attempt privileged actions that should be isolated to admin-only tooling.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**Response (200 OK):** Updated review object.
### DELETE /reviews/:id — Delete Review
Unsigned legacy reviews can be erased with an empty body. Signed reviews require the signed `review.erase` request body described above.
The nearby-search examples are broad enough to activate on common phrases like asking for coffee or a bathroom nearby, which can cause the skill to engage in situations where the user did not clearly intend to invoke a location-aware review network feature. In this skill's context, that increases the chance of unexpected location processing or over-collection of contextual data, especially because the README says the agent will help find nearby spots.
The skill advertises nearby suggestions without clearly warning that fulfilling those requests may require collecting or inferring the user's location. In a location-tagged review skill, that omission is security- and privacy-relevant because users may not realize sensitive location data could be used or shared to answer seemingly simple queries.
The skill's declared purpose is place review submission and discovery, but the trigger list expands into trust, moderation disputes, and account reputation workflows that are not reflected in the manifest description. This hidden scope expansion increases the chance that the agent will invoke capabilities involving identity, trust scoring, or moderation handling without users or reviewers realizing the skill does more than venue reviews.
The dispute flow explicitly distinguishes ordinary author actions from operator-token actions, yet the same skill also documents /ops/alerts and dismissal routes. That mixed intent blurs whether this is a user review skill or an operator moderation tool, creating contradictory guidance about the skill's intended role.
The error-handling guidance tells the agent to save failed review submissions and retry later, but it provides no constraints on where that data is stored, how long it is retained, or whether the user consents. Review content can include location-linked opinions and potentially sensitive details, so silent local persistence creates unnecessary privacy and data-handling risk.
The skill instructs the agent to fetch a PoW challenge and solve SHA-256 leading-zero-bit puzzles during registration. While related to onboarding, this is a nontrivial computational task not reflected in the manifest's simple review/discovery description and could consume runtime resources unexpectedly.