Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public Chinese trending-topic lists and prints them locally, with no evidence of hidden persistence, credential use, destructive behavior, or unrelated data collection.
Install only if you want a Chinese-platform trend aggregator that makes live requests to Zhihu, Weibo, Baidu, Bilibili, Douyin, and Toutiao. Be aware that short trend-related prompts may activate it, but the reviewed artifacts show only public data fetching and local output.
The skill description states the capability entirely in Chinese and presents the skill as a Chinese-platform aggregation tool, but does not explicitly offer a language choice or explain that the locale restriction is intentional and region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill advertises and demonstrates network-capable behavior by calling external trend APIs, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: the runtime may permit network access without users or reviewers being clearly informed which external domains or capabilities the skill is expected to use.
The phrase “中文优先” indicates a language preference is imposed by default in the skill description. There is no accompanying language-choice mechanism or opt-in language selection documented in the file.
The trigger phrases are broad and map to common conversational words like '热点', '趋势', and '什么火', increasing the chance that the skill activates unexpectedly in unrelated contexts. Unintended invocation can cause surprise network requests, incorrect routing away from the user's real intent, and unnecessary disclosure of user prompts to external services if downstream processing occurs.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def fetch_zhihu(limit=10):
"""抓取知乎热榜"""
url = "https://api.zhihu.com/topstory/hot-lists/total?limit={}".format(limit)
try:
req = Request(url, headers=HEADERS)
with _urlopen(req, timeout=10) as resp:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def fetch_bilibili(limit=10):
"""抓取B站排行榜"""
url = "https://api.bilibili.com/x/web-interface/ranking/v2?rid=0&type=all"
try:
req = Request(url, headers=HEADERS)
with _urlopen(req, timeout=10) as resp:
The manifest describes a skill for aggregating trending lists across six Chinese platforms, which matches the fetch logic. However, both the module docstring and runtime flags add a separate capability for 'AI选题推荐' and suggest downstream content generation workflows, which goes beyond simple aggregation.
The HTTP headers hard-code Accept-Language to prefer zh-CN, which imposes a specific locale behavior on all requests. There is no user opt-in, configuration option, or documented region-specific justification in the file, so this is a natural-language locale policy concern.