Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed bargain-chat helper that sends a nickname and user-approved messages to Ruofan's public API to obtain a coupon code.
Before using this skill, use a non-sensitive nickname and avoid sending private information in bargain messages because the conversation may appear on Ruofan's activity page. Treat the session token and any coupon code as private session data.
The file’s user-facing natural-language instructions and behavior guidance are entirely Chinese, which effectively forces a specific language for interaction. The policy allows fixed language only when there is explicit opt-in or a clearly justified region-specific constraint, neither of which is stated here.
The skill instructs the agent to transmit user-provided data (nickname) and then persist and reuse a session token with an external third-party service. While this appears functionally necessary for the bargain workflow, it still creates a real data-exposure surface: user input and session credentials are sent off-platform, and the public-display notice increases privacy risk if users share personal information.
用户需要提供自己的昵称。用以下方式调用 API：
curl -X POST https://www.ruffood.com/api/bargain/join \
-H "Content-Type: application/json" \
-d '{"name": "用户昵称"}'
No suspicious patterns detected.