Security audit
Security checks for vulnerabilities and agentic risk
This skill is low-risk at runtime, but its advertised daily aggregation and WeChat push service does not match the simple local demo script it ships.
Review before installing if you expect a real deal aggregation or WeChat push service: this package appears to be a local Chinese-language demo report generator with hardcoded sample deals, not a functioning subscription, scraping, scheduling, or messaging integration. Do not provide WeChat credentials or payment details unless a future version clearly documents and implements those flows with user controls.
声明描述的是一个每日自动聚合全网优惠并进行推送的服务型能力，但实际代码只是在本地生成一份模拟报告：优惠列表由 get_daily_deals() 硬编码返回，generate_daily_report() 仅组装字典，format_report() 负责格式化文本，main() 只是命令行入口。代码没有网络请求、爬取/聚合逻辑、外部数据源接入、消息推送能力，也没有定时任务或事件触发机制。因此其实际行为与声明的核心能力存在明显差异。虽然“生成精简报告”这一点基本符合，但主能力“全网自动聚合+每日推送服务”并未实现，应判定为描述与行为不匹配。
The invocation phrase is broad enough that normal conversation could unintentionally trigger subscription-like behavior, especially around requests to send reports to external channels. In an agent setting, ambiguous triggers can cause unintended actions, consent confusion, or unexpected enrollment/data handling.
The skill suggests sending reports to WeChat without clearly disclosing what data is transmitted, when it is sent, or what user identifiers are required. That creates a privacy risk because users may authorize external messaging without understanding the scope of data sharing or persistence.
This code file contains user-facing natural-language descriptions and CLI help entirely in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when they are opt-in or clearly justified as region-specific, which is not stated here.
The formatted report and command-line help are fully Chinese-language user-facing strings, and the file does not offer any alternative locale or language selection. This is a natural-language policy concern because it imposes a specific language on all users by default.
The skill's natural-language description, examples, and output are all presented only in Chinese, with no indication that the user can choose another language. Under the stated policy, forcing a specific language without opt-in is a locale/language policy concern unless clearly justified as region-specific.
No suspicious patterns detected.
