Security audit
Security checks for vulnerabilities and agentic risk
This fuel-price reminder skill is mostly coherent, but it asks for recurring monitoring and memory storage without clear user consent, limits, or an unsubscribe path.
Install only if you want a China domestic fuel-price reminder and are comfortable enabling recurring checks. Before using scheduled reminders, require explicit opt-in, choose a check frequency and end date, and make sure the memory entry and cron task can be reviewed and removed.
The skill title, triggers, usage examples, and reply templates are all presented only in Chinese and implicitly assume a single language/locale. Under the policy, forcing a specific language without user opt-in or documented justification can be a natural-language policy violation.
The description presents automatic monitoring and reminders as core behavior but does not warn that the skill may perform recurring checks or send user-impacting notifications. Lack of disclosure undermines informed consent and may surprise users with automated actions based on their prior interactions.
The trigger condition '用户询问油价' is broad enough that ordinary conversation about fuel prices could invoke the skill unexpectedly. Overbroad activation can cause unintended tool use, incorrect context switching, or surprising behavior for users, especially when combined with external search and reminder features.
The skill enables scheduled monitoring '调价窗口前 1-2 天自动监测' without clear user opt-in, duration limits, or scope restrictions. This can lead to persistent background actions and reminders that the user did not knowingly authorize, creating consent and operational safety issues.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
4. 民营加油站可能有 0.2-0.5 元/升优惠
## 相关文件
- 技能位置：`skills/oil-price-monitor/SKILL.md`
- 定时任务：`docs/cron-jobs.md`
- 用户记忆：`MEMORY.md`（记录用户关注油价）
Referencing MEMORY.md to record that a user '关注油价' introduces persistence of user preference data without any privacy notice, retention policy, or consent language. Even seemingly low-sensitivity preference tracking can become problematic if users are unaware that their interests are being stored across sessions.
No suspicious patterns detected.