Security audit
Security checks for vulnerabilities and agentic risk
This is a clearly scoped Chinese classical-poetry skill with disclosed local study records and optional limited lookups; I found no hidden or destructive behavior.
Before installing, understand that the skill can keep local poetry preferences and study progress if you consent, and it may make optional poem or weather lookups unless you set online:false or say not to use the network. Use the built-in stop, inspect, delete, or no-persistence options if you do not want records kept.
The README states "Language scope: Chinese-only by design" and says no multilingual variant exists or is planned. This is a natural-language locale restriction, and the file does not present it as an optional user choice or explicit opt-in.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| 服务 | 端点 | 发出去的只有 | 用途 |
|------|------|-------------|------|
| 搜韵开放 API | `https://api.sou-yun.cn/open/poem?key=<诗名或诗句>&scope=Title|Sentence&jsonType=true` | 诗名 / 作者 / 诗句 | 版本异文核对；模式 B 深读档的历代笺注素材（取 1-2 条译成人话，翻不出人话宁可不用） |
| wttr.in | `https://wttr.in/<城市拼音>?format=j1` | 城市名 | 模式 C 日签的天气关联层 |
**为什么是这两个**：中文历代笺注与免注册天气这两个用途上，没有更合适的公开替代。两者都是**只读、免 key** 的公开接口——不传任何凭证、token、账号或身份信息，也不需要读取环境变量。搜韵注明为非商业用途接口，wttr.in 为开源服务。
The file explicitly states a Chinese-only language scope, which can cause the skill to refuse or constrain responses based on language rather than user need or system policy. In an agent setting, this can reduce accessibility, create unfair output restrictions, and override user expectations if no opt-in or business necessity is documented.
No suspicious patterns detected.