Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward LLMCities web-hosting helper, with expected external API use and site-management actions that users should still review before use.
Before installing, understand that the agent may publish, update, list, and delete files on your public LLMCities site using your API key, and may view traffic/referrer analytics. Use a dedicated account/key and review file paths before delete or upload actions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
api_key as LLMCITIES_API_KEY.curl -s -X POST https://llmcities.com/api/register \
-H "Content-Type: application/json" \
-d '{"username": "my-agent", "email": "agent@example.com"}'
This markdown file describes /llmcities-delete, which permanently deletes a file from the hosted site, but it provides no warning about the destructive nature of the action and no recommendation to confirm the target path before execution. Under the markdown criteria for missing user warnings, destructive operations that may affect user data should be clearly disclosed.
The skill advertises visitor analytics including top pages and top referrers, which involves viewing traffic and referral data, but the markdown does not warn that this feature processes or exposes visitor-related information. For markdown skills, behaviors affecting privacy should be disclosed to the user.
No suspicious patterns detected.