Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a coherent viral-content workflow, but it asks agents to automatically generate content and may write or deploy files without a clear approval model.
Install only if you want a Chinese-platform viral-content assistant that may research trends, create files, download image assets, and support deployment. Before using it, require explicit confirmation for scheduled runs, file writes, image downloads, and any cloud deployment or publication step.
The trigger keywords are extremely broad and include common content-creation terms such as 短视频脚本, 文案, 热点追踪, and viral content. This can cause the skill to activate for unrelated requests, unexpectedly steering conversations into web search, file generation, or publishing-oriented workflows the user did not intend.
The skill description and instructions are written to enforce a Chinese-language, Chinese-platform workflow, but there is no explicit user opt-in or offered language/locale choice. This can violate language or locale policy when users may reasonably expect the skill to adapt to their preferred language.
The skill explicitly states that it will use file_write to save scripts and deliverables, but it does not warn users that files may be created or modified. In a tool-enabled agent, silent file creation can produce unwanted artifacts, overwrite expected outputs, or create content the user did not consent to persist.
The skill allows cloud_deploy to publish generated artifacts without an explicit warning or consent model for publication. Unintended deployment can expose drafts, copyrighted derivative content, or sensitive business materials to external systems, making the context more dangerous because this skill is designed for rapid content production and distribution.
The scheduled-task section says the skill can automatically reuse prior topics, track new trends, and generate multi-platform content without manual triggering. Autonomous execution materially increases risk because it can create or prepare content, and potentially chain into file writing or publishing workflows, without contemporaneous user awareness or approval.
The skill includes image downloading behavior without warning about storage, provenance, or privacy implications. While lower impact than writing or deployment, automatic downloading can still save copyrighted or inappropriate material locally and may surprise users who did not expect persistent asset collection.
No suspicious patterns detected.
