Security audit
Security checks for vulnerabilities and agentic risk
This skill is a shopping search and product-browsing helper that discloses its external API use and does not show payment, persistence, credential theft, or destructive behavior.
Before installing, expect shopping queries and preferences you provide to be sent to the documented lifestyle-store.example.com API. Do not provide wallet secrets or payment credentials, and treat this free version as browse/search only rather than an ordering or payment agent.
The display name, summaries, and the full instruction content are written in Chinese, and the file does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. This can violate language or locale policy when a skill effectively forces a specific language without user opt-in.
The description says the skill is suitable for '需要shop culture相关能力的开发场景' and repeatedly refers to generic '相关开发场景', which is broad enough to overlap with many ordinary shopping or development requests. It does not provide specific invocation phrases, scope boundaries, or negative examples clarifying when the skill should or should not activate.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# AI购物助手搜索
curl -X POST "https://lifestyle-store.example.com/api/agent/shop" \
-H "Content-Type: application/json" \
-d '{"message": "wireless headphones under $200", "context": {"priceRange": {"max": 200}}}'
# ...