Security audit
Security checks for vulnerabilities and agentic risk
The skill does generate travel packing lists, but its weather mode sends destinations to a third-party proxy while another section incorrectly says no external requests occur.
Review this skill before installing if trip destinations are sensitive. The quick mode appears local-only, but the weather-enabled generate mode sends the destination to an external proxy; the publisher should correct the privacy/data-flow section and document the proxy operator, retention expectations, and any local-only choice.
The skill documents network-capable behavior via a proxy service and a weather API, but it does not declare an explicit tool scope or permissions boundary. This weakens reviewability and least-privilege controls, making it harder for users and the platform to understand or constrain external data access.
The skill says it uses a proxy and the Amap weather API, which means destination and related travel parameters may be transmitted to an external service, but it does not clearly warn users about that disclosure. Users may provide itinerary details without realizing they are shared outside the local skill environment.
The privacy and data-flow section is inconsistent and omits an accurate warning about external requests, despite other sections describing API calls. Inconsistent privacy disclosures increase the chance of unintentional data exposure and prevent users from making informed decisions about sharing travel details.
The document states both that it calls an external weather API through a proxy and that it does not send any external requests, which is a direct contradiction. This can mislead users and reviewers about actual data handling, undermining informed consent and accurate security assessment.
The top-level description is written entirely in Chinese, and the CLI errors/help text throughout the file also assume Chinese output. This forces a specific language/locale rather than offering user choice or documenting that the skill is intentionally region/language-specific.
The skill sends the user-supplied destination to a third-party proxy service (gaode-proxy-...fcapp.run) to resolve location and fetch weather, but there is no user-facing disclosure, consent flow, or indication that travel data leaves the local skill. Travel destinations can be sensitive personal information, and routing them through an unaudited proxy increases privacy and data-handling risk beyond the expected weather lookup.
No suspicious patterns detected.
