Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed World Cup scouting/reporting workflow that gathers public match information and returns a text report.
Before installing, be aware that the skill may perform multiple public web searches and fetch odds, betting, weather, and news sources for a match report. If you want a narrower report or no betting/odds coverage, say that explicitly when invoking it.
The description says the skill activates when the user says a match like 'A队 vs B队 第X轮', but it does not define clear boundaries for when the skill should or should not trigger. In an agent environment, this can cause unintended invocation on casual sports mentions, leading to unnecessary browsing, external requests, and responses the user did not explicitly ask for.
The workflow and invocation text emphasize automatic parallel collection of 12 data sources but provide no activation boundaries or exclusions. This increases the chance of over-broad activation and can cause excessive tool use or unintended data fetching from third-party sites based on loosely related user text.
Mandating Chinese naming for all player references without user opt-in imposes a fixed language/output policy that may not match user preference or locale. While not a classic security flaw, in agent systems this kind of rigid instruction can override user intent and reduce controllability, especially for multilingual or accessibility-sensitive use cases.
No suspicious patterns detected.
