Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Chinese daily-trending fetcher that uses public tophub.today pages and does not show hidden, persistent, destructive, or credential-related behavior.
Install this if you want Chinese-language daily hot-topic summaries. Be aware that invoking it may fetch public pages from tophub.today, and its instructions prefer terse Chinese output without source labels, so users should verify important news separately.
The trigger phrases include generic terms like “热榜” that can easily match ordinary user conversation and cause the skill to activate unexpectedly. Over-broad activation can route unrelated prompts into external-fetching behavior, creating unintended network access and reducing user control over when the skill is invoked.
The manifest description, instructions, and required output format are entirely in Chinese and mandate a Chinese output style, but the file does not state that this is a China-specific skill or give users any language/locale option. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.
The skill instructs the agent to fetch data from a third-party site without disclosing that user requests may trigger network access. Even if the data is public, silent external requests can surprise users, leak request metadata, and expose the agent to untrusted remote content from the fetched site.
No suspicious patterns detected.
