Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed wrapper for a public UAPI “programmer history today” endpoint, with only minor routing and language-scope caveats.
Installing this skill is reasonable if you want an agent to use UAPI for programmer-history-on-this-day queries. Be aware that the broad 'today' trigger could activate it for unrelated date requests, and API use may contact uapis.cn or require a UAPI key if anonymous quota is exhausted.
The trigger list includes the standalone English keyword "today," which is extremely broad and likely to match many unrelated user requests. This can cause unintended invocation of this skill, leading the agent to choose an irrelevant external API path and potentially disclose user context to a third-party service when the user did not intend that action.
Listing "today" as a common keyword without any scope restriction makes the skill eligible for broad accidental matches during intent selection. In a tool-using agent, that increases the chance of misrouting benign requests into an external API workflow, which may create privacy, reliability, and least-privilege issues.
The display name, short description, and default prompt are all written only in Chinese, which can impose a language preference without any indication that the user may choose another language. The policy requires flagging language or locale constraints when they are forced without user opt-in or documented justification.
This markdown file presents the skill description, usage guidance, and response information entirely in Chinese. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language or locale choice is offered.
No suspicious patterns detected.
