Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese trending-topics fetcher that reads public web APIs and prints results without persistence, credential use, or local data access.
Install this only if you are comfortable with a skill that makes outbound requests to Chinese trend platforms and returns Chinese-language results. It does not appear to access private local data or persist anything, but it depends on public third-party APIs that may change or become unavailable.
The skill advertises network-backed functionality but does not declare any explicit tool scope or permission boundary. This can lead to over-broad execution in hosts that rely on manifest-level declarations for least-privilege enforcement, making unintended outbound requests harder to audit or restrict.
This code file contains user-facing natural language in the module docstring that assumes Chinese as the required language for use. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def fetch_zhihu(limit=20):
"""抓取知乎热榜"""
url = "https://api.zhihu.com/topstory/hot-lists/total?limit={}".format(limit)
try:
req = Request(url, headers=HEADERS)
with _urlopen(req, timeout=10) as resp:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def fetch_bilibili(limit=20):
"""抓取B站排行榜"""
url = "https://api.bilibili.com/x/web-interface/ranking/v2?rid=0&type=all"
try:
req = Request(url, headers=HEADERS)
with _urlopen(req, timeout=10) as resp:
The script prints status, report text, and usage hints only in Chinese during normal operation. Because no language selection or opt-in mechanism is offered, this appears to impose a specific language on users in violation of the stated policy.
The manifest description is entirely in Chinese ('中文全平台热搜聚合'), which indicates a Chinese-language/locale-specific skill presentation without any visible opt-in or explanation of why the locale restriction is required. This matches the policy category for language or locale constraints that are imposed without user choice or documented justification.
The title and description present the skill as exclusively Chinese-language and China-platform focused without any opt-in or language choice. Under the policy rule, language or locale constraints should either be optional for the user or clearly justified as region-specific.
No suspicious patterns detected.