Security audit
Security checks for vulnerabilities and agentic risk
This skill does the stated job of looking up Taobao/Tmall monthly sales through a disclosed EarlyData API and does not show hidden persistence, credential theft, destructive behavior, or unrelated access.
Before installing, understand that product IDs you ask about will be sent to EarlyData to retrieve sales data. The skill is mainly documented and surfaced in Chinese, so non-Chinese users may see Chinese status and error messages.
All user-facing strings, comments, and function documentation are in Chinese, and the skill returns Chinese-only status and error messages. The policy allows language constraints when users are offered a choice or when the locale restriction is clearly documented and justified, neither of which is evident in this file.
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
for package in required_packages:
try:
__import__(package)
except ImportError:
missing_packages.append(package)
The 'When to use' section provides a few positive examples, including a broad phrase like '帮我看看这个天猫商品卖了多少', but does not specify exclusion conditions or a precise trigger scope. This can cause unintended invocation when users casually discuss product sales without clearly requesting this specific API-backed lookup.
The function sends a user-supplied product identifier, derived from a product URL or raw item ID, to a third-party service (mi.earlydata.com) without any visible disclosure, consent, or privacy notice in the skill logic. While the data is not highly sensitive by itself, this still exposes user-provided input and usage patterns to an external party and may violate user expectations or platform data-handling requirements.
No suspicious patterns detected.