Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent but should be reviewed because it can publish directly to a user's Weibo account without a clear mandatory confirmation step.
Install only if you are comfortable with an agent using your logged-in Weibo browser session. Before use, verify the exact account and post text, and require an explicit final confirmation before the agent clicks send.
The trigger phrases include broad natural-language requests like '帮我发微博', which can match common conversational text and increase the chance of unintended activation. Because this skill performs an external side effect—publishing to a social-media account—accidental triggering can cause unauthorized or embarrassing posts, and the post may be difficult or impossible to fully retract.
The skill description says it posts to Weibo but does not prominently warn users about the privacy, account, and irreversibility implications of submitting content to an external public platform. In this context, weak disclosure is risky because the workflow directly automates browser actions to publish content, and users may not realize the action is public and not easily undoable.
No suspicious patterns detected.
