Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Zao Live audio-share link generator with broad trigger phrases that users should be aware of, but no hidden code, persistence, credential use, or local data access was found.
Install this only if you want generic Chinese news, podcast, or audio requests to potentially return a Zao Live share link. The publisher should narrow the trigger phrases or require clarification for ambiguous requests, but the inspected artifact does not show malicious behavior.
The skill advertises broad natural-language triggers like '听新闻' and similar generic audio/news requests, which can cause the skill to activate when a user did not specifically intend to invoke this domain. That can route unrelated requests to an external service and produce unexpected link-sharing behavior, reducing user control and creating an invocation-hijacking risk.
The recommendation-style triggers are vague and unconstrained, making it unclear when this skill should be selected over other content or assistant capabilities. In practice, this increases the chance of accidental activation and inappropriate redirection to a third-party link instead of fulfilling the user's actual request.
No suspicious patterns detected.
