Security audit
Security checks for vulnerabilities and agentic risk
This is a small Chinese meme-assistant skill that discloses its web-search behavior and does not include code, persistence, credential access, or hidden installation behavior.
Install this if you want a Chinese meme helper and are comfortable with it using web search for meme origins and trend checks. Avoid sending private or sensitive text for lookup, since searched phrases may be shared with external search providers.
The top-level skill metadata includes broad trigger phrases such as “meme”, “整活”, and “抽象”, which can appear in normal conversation and cause the skill to activate unexpectedly. Unintended activation is risky here because the skill’s documented behavior includes external web searches, potentially causing unnecessary network access and user-surprising behavior.
The file describes the skill as a Chinese internet meme skill and presents all activation and operating instructions in Chinese, effectively constraining the interaction to a specific language/locale. It does not explicitly offer language choice or explain that the locale limitation is an intentional, justified constraint for a region-specific tool.
The decoder trigger list contains ambiguous phrases like “什么意思” and “出处是什么”, which are common across many non-meme conversations. This can route unrelated requests into the meme skill, degrading correctness and potentially triggering unnecessary searches.
The meme-making trigger list includes vague activators such as “整活” and “变成梗”, which are colloquial and may be used in broader creative contexts. This creates a prompt-routing weakness where the wrong skill may engage, leading to confusing or unintended outputs.
The skill explicitly mandates online searches and hot-list fetching for several functions, but it does not require user notice or consent at the moment of external access. This can expose user-provided meme text or interests to third-party services unexpectedly and violates least-surprise/privacy expectations.
The trigger phrase "热梗" is short and context-light, so it may match incidental mentions rather than a deliberate request to run the trending-meme workflow. The description does not specify required phrasing, invocation context, or non-trigger examples.
No suspicious patterns detected.
