Security audit
Security checks for vulnerabilities and agentic risk
The skill has no embedded code, but it promotes arbitrary always-on web scraping without clear limits or safeguards.
Install only if you intend to use it for websites and data sources you are authorized to access. Before running any scraper based on this skill, define target allowlists, rate limits, privacy handling, and compliance checks, especially because the artifact itself does not provide those guardrails.
The skill advertises extraction from 'any website' without narrowing scope, permission boundaries, or allowed use cases. That broad claim encourages indiscriminate scraping of arbitrary targets, which can lead to collection of sensitive data, ToS violations, or use against sites that should not be accessed automatically.
The skill promotes continuous automated scraping and API integration but provides no warning about legal, ethical, operational, or privacy risks. In context, 24/7 unattended operation increases the chance of abusive traffic, mass collection, account blocking, or accidental extraction of protected data.
The README presents the skill description only in Chinese, which can constitute a language/locale policy issue when no alternative language or user choice is offered. There is no indication that the skill is region-specific or intentionally limited to Chinese-speaking users.
The natural-language description and headings are entirely in Chinese, and the file does not indicate that this language choice is optional or limited to a specific region-specific use case. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
No suspicious patterns detected.
