AI Topic Scout

This skill is coherent with its stated purpose, but pay attention to two practical security issues before installing: 1) Credentials not declared: The instructions require a DingTalk MCP Server Streamable HTTP URL and X/Twitter cookies (auth_token and ct0). These are sensitive credentials but the skill metadata does not declare them. Only provide them if you trust the skill and the environment where mcporter will send data. 2) Cookie-based Twitter auth: Extracting auth_token and ct0 from your browser is sensitive—these cookies grant access tied to your account. Prefer using a proper API token/session mechanism (if available), store tokens securely (not world-readable files), and avoid reusing personal account cookies on shared/dedicated servers. 3) Global installs & supply-chain: The skill asks you to npm -g / pip install several CLIs and to clawhub-install other skills. Review the npm/pypi packages (mcporter, @steipete/bird, yt-dlp, clawhub) and consider installing in a controlled environment (virtualenv, container, or dedicated VM) to limit blast radius. 4) Verify MCP endpoint: The mcporter registration requires you to provide the MCP Server URL — confirm this endpoint is a trusted DingTalk MCP server for your org and not a third-party capture endpoint. If you want to proceed: run the installs in an isolated environment, avoid exposing your main browser cookies (create a dedicated account or use API credentials), and verify the npm/pip packages' sources and versions. If you want, I can list the exact places where credentials are used in the workflow and suggest safer alternatives (OAuth, read-only service accounts, or rotating tokens).