Security audit
Security checks for vulnerabilities and agentic risk
This is a small API-invocation skill for market-entity statistics; its network call and API key use are disclosed and purpose-aligned, though users should handle the key carefully.
Install this only if you intend to let the agent call the documented dfwycredit endpoint for market-entity statistics. Provide the API key through a secure secret mechanism, avoid pasting real keys into prompts or logs, and confirm whether the rcd-test endpoint is appropriate for your environment.
The description says "Invoke when user needs market entity statistics or business data." The phrase "business data" is broad and ambiguous, and the file does not provide exclusion conditions or negative examples to narrow when the skill should or should not activate.
The skill documentation requires an API_KEY and describes sending it to a remote endpoint, but it does not include any warning about secret handling, storage, redaction, or user consent around data disclosure. In an agent environment, this increases the risk of credentials being mishandled, logged, or sent to an unintended environment, especially since the endpoint is an external test-domain service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
统一入口调用方式：
curl --location 'https://rcd-test.dfwycredit.com/s1/skill/unified-invoke' \
--header 'Content-Type: application/json' \
--data '{
"category": "3.3",
No suspicious patterns detected.