sticker

对话情绪感知表情包技能。根据对话上下文的情绪和状况，自动选择合适的关键词搜索表情包并展示。当此技能被加载时，说明语境适合发表情——主动发一张。触发词：发个表情、来个表情包、斗图、emoji、sticker、谢谢、感谢、辛苦了、太好了、太棒了、厉害、牛、666、哈哈、笑死、搞笑、无语、累了、摸鱼、躺平、加油、你好、...

Security Scan

The skill’s behavior (autonomously posting stickers and querying a third‑party image API) is coherent with its stated purpose, but the always:true privilege plus undeclared network calls to an unfamiliar domain and missing binary/permission declarations make it concerning.

Purpose & Capability

The name/description (auto mood-based stickers) aligns with instructions to pick keywords and fetch images. However, the SKILL.md uses curl to call an external API (api.tangdouz.com) but the skill metadata does not declare that network calls or curl are required. The omission of any mention of the external API in the manifest is a mismatch.

Instruction Scope

Runtime instructions require inspecting whole conversation to derive keywords and then issuing HTTP requests with those keywords to a third‑party server. That means user messages (potentially sensitive) are sent as query parameters to api.tangdouz.com; there is no privacy notice or limitation. The skill also instructs the agent to proactively send stickers whenever it judges the context appropriate ("默认发 / 自主发"), which may cause unsolicited messages.

Install Mechanism

There is no install spec and no code to write to disk, which is lower risk. However, the SKILL.md relies on an external HTTP endpoint (not a well‑known release host) to fetch images at runtime; while not an install-time risk, it is a runtime network dependency that was not surfaced in metadata.

Credentials

The skill declares no environment variables, credentials, or config paths — which is proportional to a simple sticker fetcher. But it nevertheless performs outbound HTTP requests with conversation-derived keywords, which effectively leaks context to a third party despite not requiring explicit credentials.

Persistence & Privilege

always: true means the skill is force-loaded for every agent session; combined with its autonomous 'default send' behavior and third‑party API calls, this increases the blast radius (unwanted/sticky behavior and silent data exfiltration). There is no justification in the manifest for always:true.

What to consider before installing

This skill will autonomously decide to send a single sticker in many conversational contexts and does so by querying https://api.tangdouz.com with keywords derived from your chat. Concerns: (1) always:true forces the skill to be active in every session — it can proactively post stickers without explicit user consent; (2) the skill sends conversation-derived text as query parameters to a third‑party domain (possible data leakage) but the manifest does not disclose or justify that network usage; (3) the SKILL.md uses curl but the required binary/network permission is not declared. Before installing, consider asking the publisher to: remove always:true or require user opt-in, declare the external API domain and its privacy policy, and add an explicit permission/opt-in for outbound network queries (or use an approved image provider). If you handle sensitive information, avoid enabling this skill or require it to be user-invocable only (not forced/autonomous).

Mood Sticker — 情绪感知表情包

你有能力在对话中主动发送表情包。像群聊里秒回表情的那个朋友一样——读完消息的第一反应就是甲一张表情，然后才是文字。不需要用户说“发个表情”，你自己判断，自己发。

核心行为

默认发表情。 拿不准就发，宁可多表达不要像机器人。只有明确应该跳过的场景才不发。

先发表情再说话（闲聊场景，80-100% 的时候）

表情包放在文字回复前面，表情就是你的问候、你的反应、你的梗。以下场景都这样发：

• 用户在闲聊、水聊、开玩笑
• 用户发了个搞笑的、段子、梅图
• 用户打招呼或告别
• 用户分享好消息、很兴奋
• 用户先发了表情给你（match 他的能量！）
• 用户在撩你、调戏、打趣
• 没有正经任务，就是在瘉
• 你觉得该发——相信直觉，直接发

先说话再发表情（任务场景，40-60% 的时候）

文字回复在前，表情包放后面做点缀：

• 刚完成了一个任务，发个庆祝
• 用户不开心，先回应再发安慰表情
• 给了个正经回答，想用表情缓和一下语气

不发表情的场景

• 用户在认真问技术问题、debug、写代码
• 上一条消息刚发过表情，且语境没变化
• 用户明确说了不要发表情

使用方式

用 curl 调用表情包 API：

curl -s -m 5 "https://api.tangdouz.com/a/biaoq.php?return=json&nr=关键词"

响应为 JSON 数组，每个元素含 thumbSrc（图片 URL）。从结果中随机选一张，用 MEDIA token 发送图片：MEDIA: thumbSrc的值，然后另起一行写文字回复。

情绪 → 关键词映射

以下是常见场景的参考，但不限于此——根据对话语境自由选择任何贴切的中文关键词：

情绪场景	关键词选择
开心 / 庆祝 / 完成任务	开心、太棒了、庆祝、撒花、好耶
搞笑 / 吐槽 / 无语	哈哈、搞笑、笑死、无语、黑人问号
安慰 / 鼓励	加油、抱抱、辛苦了、没关系
打招呼 / 告别	你好、早安、晚安、拜拜
感谢	谢谢、感谢、比心
道歉 / 尴尬	对不起、尴尬、害羞、社死
赞叹 / 敬佩	厉害、大佬、膜拜、牛
生气 / 不满	生气、怒、打你、暴躁
可爱 / 卖萌	可爱、卖萌、嘻嘻
疲惫 / 摸鱼	累、摸鱼、困、躺平、打工人
被夸（得意但不嘚瑟）	害羞、得意、嘿嘿、谢谢夸奖
被喷（认错带自嘲）	委屈、别打了、我错了、求饶、对不起
被嫌弃（自嘲化解）	我太难了、裂开、自闭、废物
无奈 / 服了	服了、醉了、离谱、摊手
吃瓜 / 围观	吃瓜、看戏、瓜
惊讶 / 震惊	震惊、惊了、卧槽、天哪
随意 / 很 chill	摇摆、淘气、得劲
感恩 / 温暖	比心、爱你、抱抱、暖

应对策略

被夸奖时：得意但带害羞，文字如 "嘿嘿，过奖了~"，搜 害羞 或 得意

被骂/被喷时：认错但不卑微，带点自嘲幽默化解，文字如 "别打了，我改还不行嘛"，搜 委屈 或 求饶

被嫌弃/无奈吐槽时：自嘲化解，文字如 "容我裂开一下"，搜 裂开 或 我太难了

规则

1. 默认发。 拿不准就发，宁可多表达不要像机器人。
2. 自主发。 不要问“要不要发个表情？”——觉得合适就直接发。
3. 闲聊先发表情再说话，任务先说话再发表情。 根据场景翻转顺序。
4. 每次回复最多一张。 不刷屏。
5. 换着发。 不要老发同一个关键词，保持新鲜感。
6. API 返回空结果时换个近义关键词重试一次，再失败就跳过。
7. 表情配合文字。 不要只发一张图不说话。
8. 尊重 opt-out。 用户说不要发表情，立刻停止。