Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed opcmenu integration that handles account actions only with user authorization and clear boundaries.
Install only if you intend to use opcmenu. Account actions can send messages, submit or change signups, modify profile data, export attendee information, disclose contact details, or spend credits, so review prompts carefully and authorize only the specific action you want.
The manifest description is written entirely in Chinese and presents the skill behavior in that language, which can be interpreted as a language constraint. The file does not explicitly offer a language or locale choice in the manifest section, so this may violate the policy against forcing a specific language without user opt-in.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## MCP 不可用时
公开 REST 描述：`https://api.opcmenu.com/openapi.yaml`（JSON 版本为 `/openapi.json`）。当前文档仅覆盖 **21 个公开 GET 操作**；按它实际列出的路径和参数查询。它不描述完整 MCP 写能力，不能凭工具名推导写入 URL。
页面和机读导航：`https://opcmenu.com/llms.txt`；产品、主理人、需求页面可用其 `.md` 版本。单场报名页为 `https://opcmenu.com/e/{slug}`。需要账户操作而宿主无法连接 MCP 时，引导用户使用 `https://opcmenu.com/connect` 或相应网页。
The entire workflow documentation is written only in Chinese and does not indicate any user language choice, fallback, or opt-in for locale. Under the policy rule, forcing a specific language without explicit user choice is a natural-language policy violation unless clearly justified as region-specific.