Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed shift-scheduling connector that sends schedule data to its stated platform API and does not show hidden persistence or deceptive behavior.
Install only if you are comfortable sending employee names, availability, and schedule details to the AI Skills platform or your configured self-hosted endpoint. Review pricing before paid generate/update/export operations, keep API keys in environment configuration, and do not paste full keys into chat or logs.
The natural-language content in the manifest description and the markdown instructions consistently forces Chinese as the interaction/documentation language. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.
This markdown file contains all user-facing behavioral and safety instructions in Chinese, and nowhere indicates that the user may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.
The entire skill reference is written only in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
/api/v1/shift-scheduler/schedule.export；/api/v1/shift-scheduler/schedule.export/tasks/{task_id}curl -sS -X POST "$BASE/shift-scheduler/schedule.read" \
-H "Authorization: Bearer ${SHIFT_SCHEDULER_API_KEY:-$AI_SKILLS_API_KEY}" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $REQUEST_UUID" \
This file contains user-facing operational documentation entirely in Chinese and does not indicate that other languages are available or that Chinese is required for a justified region-specific context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.