Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Chinese package-tracking helper that uses one disclosed logistics website and does not install code, persist data, or request unusual privileges.
Install this if you are comfortable sending tracking numbers or pasted delivery-message text to kuaidi100.com through browser automation. Avoid pasting unnecessary personal details, and expect the skill to fail rather than bypass verification if the site asks for a captcha, login, or phone verification.
The trigger conditions include very broad natural-language phrasing such as generic requests to check a package, fragments of recipient info, or colloquial courier questions. That increases unintended invocation risk, which can cause the agent to open a live logistics website and process potentially sensitive shipment identifiers or phone-related data when the user's intent was ambiguous.
The skill hard-codes Chinese output formatting and does not preserve or negotiate the user's preferred language. This can cause misleading or unusable responses for users operating in another language, increasing the chance of misunderstanding time-sensitive delivery status or verification instructions.
No suspicious patterns detected.
