Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward 360 Search helper that sends user search terms to so.com, with some documentation and packaging rough edges but no hidden or destructive behavior found.
Install only if you are comfortable sending search queries to 360 Search/so.com. Expect Chinese-only output and some packaging issues, such as missing or inconsistent example files, but the inspected artifacts do not show hidden persistence, credential access, or destructive actions.
Natural-language strings in the file, including the module description and runtime messages, are primarily in Chinese, which can impose a language choice on users without opt-in. The file does not document that this skill is intentionally limited to a Chinese-speaking or region-specific context.
This code sends the user-provided query to https://www.so.com via a browser navigation request, which is a network operation that transmits user data to a third party. While the file describes that it performs web search, it does not include any explicit warning, confirmation, or disclosure that user-entered queries will be sent externally.
The news search method constructs a remote so.com URL using the supplied query and loads it in Playwright, transmitting the query to an external provider. The method lacks any explicit user disclosure or warning about this data transfer.
This method issues a network request to so.com with the user's image-search query embedded in the URL. There is no explicit warning in comments, docstrings, or user-facing output that the query will be transmitted to a third-party search engine.
SQP-3 applies to all file types and includes language or locale policy issues. The visible natural-language documentation is entirely in Chinese, and the file does not indicate that this language choice is optional, user-selectable, or justified by a region-specific constraint.
This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. The documentation tells users to check .env.example for required environment variables but provides no warning about whether those variables may include API keys or other sensitive data, which is relevant for a search skill that likely interacts with external services.
This Python file performs an image search via client.search_image(...), which implies a network/HTTP request transmitting the user-provided query to an external service. The script has no confirmation prompt, user-facing disclosure, or explanatory comment/docstring warning that the query will be sent out, so users invoking the script from code alone are not informed of that data transmission.
The docstring and usage message are written only in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the stated policy, forcing a language or locale without user choice is a natural-language policy violation.
This Python file creates a Search360Client and performs a news search, which likely issues network requests based on user-supplied query data. The script provides usage text but no explicit warning, log, or comment disclosing that the query will be transmitted to an external search service.
The file’s docstring and all user-facing messages are in Chinese, including status output and assertion text. This imposes a specific language/locale without any opt-in or indication that the skill is intentionally region-specific, which matches the natural-language locale policy concern.
