Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese public-ranking crawler that fetches live public trend, music, entertainment, app chart, and newspaper data without credentials, persistence, or local data access.
Install this only if you want an agent to make live network requests to Chinese public content platforms for rankings and newspaper metadata. For vague news or recommendation requests, users may want to ask the agent to clarify before running the crawler, because the skill's trigger examples are intentionally broad.
The skill claims broad support for music rankings, entertainment rankings, App Store rankings, and People's Daily scraping, but the analyzed behavior reportedly only supports five hot-search platforms. This description-behavior mismatch is dangerous because the agent may route unrelated user requests into a skill that cannot satisfy them, causing unnecessary code execution and network access under false pretenses.
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
Referenced artifact was not completely inspected
→ 使用 `crawl-paper.js`
The skill instructs the agent to run Node.js crawler scripts that fetch live data from external sources, but the manifest does not declare any tool scope such as network permissions or allowed tools. This weakens policy enforcement and reviewability because the skill's effective capabilities exceed what its metadata advertises, increasing the risk of unintended external access when the skill is invoked.
The trigger phrases for hot topics are extremely broad, including generic requests like '今天发生了什么' or '有什么热点新闻', which overlap with ordinary conversation and news queries. This can cause the agent to invoke a networked crawler skill more often than necessary, expanding attack surface and enabling unneeded external data retrieval for loosely related prompts.
The music trigger list includes everyday phrases such as '什么歌好听' and '现在流行什么歌', which are subjective recommendation requests rather than clear requests for supported chart data. This can misroute benign conversation into external script execution and produce misleading behavior by conflating recommendation with scraping.
The entertainment guidance maps subjective queries like '最近什么电影好看' or '有什么好玩的游戏' to crawler execution, even though these are recommendation-style requests and may not require external scraping. This broad routing can unnecessarily activate code and network access, while also increasing the chance of irrelevant or low-quality results being presented as authoritative.
The newspaper/news trigger phrases include generic terms like '今日新闻头条' and '日报', which can collide with broad news questions not specifically requesting People's Daily edition data. In context, this is risky because it may steer the assistant into fetching and presenting a narrow external source when a user asked for general news, causing over-collection and mis-scoped tool use.
The example mappings reinforce broad conversational triggers like '今天有什么大事' and '帮我吃个瓜' as reasons to run the skill. These examples train the agent toward over-invocation of a network-capable skill for vague requests, making accidental data fetching and policy bypass through prompt phrasing more likely.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// 微博热搜
async function crawlWeibo() {
const res = await fetch('https://api.weibo.cn/2/guest/search/hot/word?from=10DA093010&c=iphone', {
headers: { 'User-Agent': UA }
})
const json = await res.json()
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
async function crawlQQ(type) {
const idMap = { hot: 26, rising: 62 }
const id = idMap[type] || 26
const url = `https://i.y.qq.com/n2/m/share/details/toplist.html?ADTAG=ryqq.toplist&type=0&id=${id}`
const res = await fetch(url, {
headers: { 'User-Agent': UA, 'Referer': 'https://y.qq.com/' }
})
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
async function crawlQQ(type) {
const idMap = { hot: 26, rising: 62 }
const id = idMap[type] || 26
const url = `https://i.y.qq.com/n2/m/share/details/toplist.html?ADTAG=ryqq.toplist&type=0&id=${id}`
const res = await fetch(url, {
headers: { 'User-Agent': UA, 'Referer': 'https://y.qq.com/' }
})
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
async function crawlQQ(type) {
const idMap = { hot: 26, rising: 62 }
const id = idMap[type] || 26
const url = `https://i.y.qq.com/n2/m/share/details/toplist.html?ADTAG=ryqq.toplist&type=0&id=${id}`
const res = await fetch(url, {
headers: { 'User-Agent': UA, 'Referer': 'https://y.qq.com/' }
})
This markdown file presents all usage instructions, parameter descriptions, and output format text exclusively in Chinese. That can constitute a language/locale policy issue when users are not given an opt-in choice or an explicit note that the document is intended only for a Chinese-speaking audience.
This markdown file presents all instructional and schema commentary in Chinese and does not mention alternative language support or that Chinese is a required locale. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The request to Apple's charts hard-codes the Accept-Language header to 'zh-CN,zh;q=0.9', which forces a specific language/locale behavior. This is a natural-language policy concern because the file provides no user opt-in, fallback, or explanation that the crawler is intentionally China-specific.
No suspicious patterns detected.