Security audit
Security checks for vulnerabilities and agentic risk
This recipe-only automation skill is understandable, but several examples can automatically send messages, publish posts, upload data, or store social-media content without built-in safeguards.
Review each recipe before enabling it. Add approval or draft steps for email replies and public posts, limit schedules and keyword matches, verify any S3 bucket and database settings, and avoid backing up or storing sensitive data unless encryption, access controls, and retention are clear.
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
actions:
- type: fetch
url: https://news.ycombinator.com/rss
- type: summarize
prompt: "总结今日科技新闻，列出前 5 条"
- type: send
to: telegram
The skill documents automatic email replies triggered by keywords, which can send messages on the user's behalf without any warning, confirmation step, rate limit, or scope restriction. This creates a real safety issue because misconfiguration or broad matching could cause unintended outbound communication, reputational harm, or auto-response loops.
The multi-platform publishing recipe automates public posting to several platforms without warning that generated content will be published externally. This is dangerous because users may unintentionally disclose sensitive, inaccurate, or unreviewed content to public audiences across multiple accounts at once.
The backup recipe copies local data from a user directory to remote S3 storage without warning that local files will leave the device and be stored in cloud infrastructure. This is risky because users may back up sensitive data to an unintended bucket, region, or account without understanding confidentiality and retention implications.
The social-media monitoring recipe collects third-party content based on keywords and stores it in a database without warning about data collection, retention, or privacy considerations. This can create compliance and privacy risks if users store personal data, defamatory content, or platform-restricted content without realizing the implications.
The file's descriptive and instructional text is entirely in Chinese, and one recipe explicitly generates Chinese output, but there is no indication that the skill is region-specific or that users can choose another language. This may conflict with a language/locale policy requiring user choice or documented justification for a fixed locale.
No suspicious patterns detected.