Security audit
Security checks for vulnerabilities and agentic risk
This nickname-generation skill is not malware, but it pressures users to disclose gender before helping, which is unnecessary for the task.
Install only if you are comfortable with the skill asking about gender during nickname creation. A safer version should make demographic questions optional and accept style preferences instead.
The trigger description contains broad, common phrases like '帮我起个名' and '求个名字', which can cause the skill to activate in contexts unrelated to nickname generation. Over-broad activation can misroute user requests, create unintended data collection prompts, and reduce user control over when this behavior is invoked.
The instructions require collecting gender information but provide no notice that sensitive personal data is being requested, no justification for necessity, and no skip path. In a casual naming skill, this creates avoidable privacy risk and normalizes coercive collection of personal attributes for a non-essential purpose.
The skill explicitly requires collecting sex/gender before proceeding and instructs the agent to keep pressing if the user does not answer. Gender can be sensitive personal data, and making it mandatory for a nickname-generation task violates data minimization and can pressure users into disclosure, especially when the task can be completed without that information.
No suspicious patterns detected.
