Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently looks up Taobao/Tmall product details through a disclosed third-party API and does not show hidden persistence, credential access, or destructive behavior.
Before installing, be aware that product IDs you query are sent to EarlyData over HTTPS, and responses/errors are primarily in Chinese. The skill appears narrowly scoped to product lookup and does not request credentials or modify local data.
The 'When to use' section provides example utterances, but it does not define explicit trigger constraints or negative examples, and one example ('帮我看看这个天猫商品的详细信息') is broad enough to overlap with ordinary conversation. This can cause unintended invocation because the document does not clarify when the skill should not activate.
This code file contains natural-language content exclusively in Chinese across comments, docstrings, dependency errors, and return messages. The skill does not offer a language/locale choice or document that it is intentionally limited to Chinese users, which creates a language-policy issue under the stated rule.
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
for package in required_packages:
try:
__import__(package)
except ImportError:
missing_packages.append(package)
This markdown file is entirely presented in Chinese, including headings, parameter descriptions, and support instructions. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
No suspicious patterns detected.