Security audit
Security checks for vulnerabilities and agentic risk
This is a travel-planning prompt skill with no executable code, no required credentials, and only expected informational search/map use.
Before installing, treat this as an informational travel planner. It may rely on live search or map tools and may ask for trip dates, destination, ages, mobility needs, and budget. It should not make bookings or payments for you; verify prices, accessibility, and ticket rules with official providers.
This markdown file contains user-facing instructions and examples only in Chinese, while L77 states the skill supports both Chinese and English. Under the policy, forcing or effectively defaulting to a specific language without user opt-in is a natural-language policy concern.
The trigger includes generic phrases like "traffic" and "offbeat destinations," which commonly appear in ordinary travel conversations and do not clearly distinguish when this specific module should activate. The file also does not provide exclusion conditions or negative examples to limit unintended invocation.
The prompt defines the assistant role and behavior entirely in Chinese, which effectively constrains interaction language without indicating that the user may choose another language. This is a natural-language policy concern because it imposes a locale/language expectation rather than offering an explicit user opt-in.
The prompt labels capability 3 as a ticket/hotel booking assistant, yet explicitly says '不直接代订，仅提供信息' ('does not directly book, only provides information'). Given the manifest also advertises 'booking integration,' this documentation creates conflicting expectations about whether the skill performs bookings or merely informs users about booking channels.
No suspicious patterns detected.
