Security audit
Security checks for vulnerabilities and agentic risk
This skill is mostly a Xiaohongshu content workflow, but it can automatically delete existing Feishu schedule rows and includes cover-generation wording aimed at avoiding duplicate checks.
Review before installing. Use it only with Feishu access limited to the intended Xiaohongshu project tables, and require a preview or explicit confirmation before overwriting or deleting schedule rows. Also consider revising the cover prompts to emphasize original, licensed visuals rather than avoiding duplicate-detection checks.
The listed trigger phrases include generic expressions such as '生成排期表', '文案排期', '生成封面', and '封面生成', which are broad enough to match ordinary user requests outside this specific skill. The description does not provide exclusion conditions or narrow context constraints to reduce unintended invocation.
The skill instructs the agent to automatically delete existing records that conflict on date+account before writing new entries, without requiring explicit user confirmation, backup, or audit visibility. This creates a destructive action path where a mistaken project match, bad date range, or ambiguous account mapping could silently erase legitimate scheduling data. Because the skill writes to live Feishu tables, the context makes the risk more concrete.
The cover-generation instructions explicitly include '防查重' behavior by modifying scenes to avoid matching source images too closely. That shifts the feature from ordinary derivative design guidance toward evasion of duplication/originality checks, which can facilitate misleading reuse of copyrighted or proprietary visual material. In this marketing-skill context, the instruction is not necessary for core functionality and increases abuse potential.
No suspicious patterns detected.
