Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed model-provider switcher whose external API endpoints and configuration use match its stated purpose.
Before installing, confirm you trust the provider endpoints you configure and understand that prompts may be sent to the selected LLM provider. Use your own API keys, watch for provider billing/data policies, and note that the usage examples are written mainly for Chinese-language invocation.
The activation and query examples are all written as Chinese phrases, which implies the skill is intended to be invoked in a specific language. The file does not offer alternative language options or explain that the skill is intentionally limited to a Chinese-language environment, creating a natural-language policy concern.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"models": {
"providers": {
"minimax-portal": {
"baseUrl": "https://api.minimaxi.com/anthropic",
"apiKey": "your-key"
},
"local": {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"apiKey": "your-key"
},
"local": {
"baseUrl": "https://api.scnet.cn/api/llm/v1",
"apiKey": "your-key"
}
}
The manifest description is written only in Chinese ("切换不同LLM API提供商"), which can impose a language-specific experience without offering users a language choice or documenting a justified locale restriction. The policy specifically calls for flagging language or locale constraints when they are not optional or clearly justified.
No suspicious patterns detected.