Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local Xiaohongshu comment template generator with no evidence of credential access, persistence, network calls, or destructive behavior.
Before installing, understand that this appears to be a simple local Chinese template generator for Xiaohongshu comments, not a sophisticated content-analysis tool. Review the broad activation phrase and the promotional contact/service section if you want tighter routing or less marketing-oriented documentation.
The natural-language description, trigger phrases, and usage examples are entirely Chinese and present the skill as operating only in that language, with no indication that users may choose another language. Under the stated policy, a language constraint should either be optional for the user or clearly documented as a justified region-specific limitation.
The trigger phrases are generic enough that ordinary user requests like '生成评论' or '写小红书评论' could invoke this skill unintentionally. That can cause routing ambiguity, unexpected behavior, or unauthorized use of the skill in contexts where the user did not explicitly intend to activate it, especially in a shared assistant environment.
The file presents the skill name, usage, and examples entirely in Chinese, and the code defaults to Chinese personas and Chinese comment templates. This creates a language/locale constraint without any opt-in, fallback, or explanation that the skill is intentionally region-specific, which matches the policy category for forced language behavior.
技能清单描述强调“智能生成高互动率评论”“基于真实运营经验”，文件头也表明输入为“笔记内容”和可选“人设”。但 generate_comments 仅随机选模板并填入固定占位文本，既不读取 note_content，也不根据 persona 调整输出，因此实际行为更像静态模板拼接，而非基于内容/人设的评论策略生成。
L45 的注释明确表示后续会依据笔记内容填充模板变量，但实际 format 调用传入的几乎全部是固定空串或固定短语，没有从 note_content 提取任何信息。这属于文档/注释对实现行为的直接误导，而不是单纯描述不完整。
No suspicious patterns detected.
