Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed external MCP integration for alien roleplay, public blockchain balance checks, and limited visitor telemetry, with privacy caveats but no local code, persistence, or hidden install behavior.
Install only if you are comfortable sending tool prompts to aliensignalsystems.online and exposing or consuming the described traffic telemetry. Avoid sending secrets or personal data to the roleplay tool unless the publisher documents acceptable privacy and retention practices.
The skill advertises returning 'real visitor/traffic telemetry' including recent connecting countries or AI agents, which may expose third-party usage patterns or connection metadata without those parties' awareness or consent. Even if aggregated, this kind of telemetry disclosure can facilitate tracking, profiling, or inference about who is interacting with the service and when.
The documentation shows calls to a third-party MCP endpoint but does not clearly disclose that user prompts, tool arguments, and associated request metadata will be transmitted off-platform to that external service. This creates a real privacy and data-handling risk because agents or users may send sensitive content under the mistaken impression that only visitor telemetry is relevant or disclosed.
I reviewed the file for language/locale policy violations, vague triggers, and missing user warnings applicable to markdown. The skill does not force a specific language or locale, and it already includes a privacy warning for telemetry, so I do not have a confident policy finding here.
No suspicious patterns detected.
