Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims, but it can send sensitive content, exact locations, and paid physical observation requests to outside humans without enough consent and safety boundaries.
Review this skill carefully before installing. Use it only when you are comfortable sending the submitted text, context, and any location details to the 2O service and human reviewers. Avoid secrets, regulated personal data, private addresses, exact GPS coordinates, or photos unless the user has explicitly approved the disclosure and the request cannot facilitate tracking, surveillance, harassment, or physical harm.
The witness-observation feature solicits real-world addresses, GPS coordinates, and optional photos, but it lacks any safety warning about privacy, stalking, doxxing, surveillance, or exposure of sensitive locations. Because the skill is specifically designed to route these requests to humans in the physical world, misuse could endanger people or disclose highly sensitive location data.
The skill instructs agents to send claims, drafts, and other user-provided content to an external human-review service, but the description and setup text do not clearly warn that sensitive user data may be transmitted to third parties. This can cause unintentional disclosure of confidential, regulated, or personal information because an agent may use the skill without obtaining informed user consent.
This skill explicitly transmits user-supplied claim data and associated context to an external API endpoint, which is expected functionality but still a real data-exposure risk. In the context of a human-verification service, the danger is not the network call itself but the absence of guardrails limiting what may be sent, especially if agents forward sensitive prompts, drafts, or personal information.
Use this when you need a human expert to verify whether a claim is true, false, or partially true.
curl -s -X POST "https://www.2oapi.xyz/api/v1/verify" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TWO_O_API_KEY" \
-d '{
No suspicious patterns detected.