Security audit
Security checks for vulnerabilities and agentic risk
The skill appears non-destructive, but it advertises live Baidu trend monitoring while actually returning hardcoded mock results.
Install only if you want a demo or template. Do not rely on this skill for real Baidu hot-search monitoring or business decisions unless it is updated to fetch live data and clearly label freshness and source in every output.
The skill claims live monitoring of Baidu hot searches, trend analysis, and keyword popularity, but the content only describes mock data and hypothetical API use without implementing those capabilities. This mismatch can mislead users and downstream agents into trusting fabricated or stale data as real-time intelligence, which is especially risky for monitoring, research, or business decisions.
Without declared permissions the skill's intent is opaque and cannot be validated.
The trigger phrases include very broad everyday terms like '百度' and '热搜', which are likely to activate during ordinary conversation unrelated to explicit skill invocation. Overbroad activation can cause unintended routing, surprising behavior, and accidental disclosure of user intent to a skill that may fetch or fabricate external-topic data.
The module documentation presents the script as a Baidu hot list fetcher, but the code only serves simulated entries. Misleading documentation increases the chance that users trust the output as authentic external intelligence, creating integrity and decision-making risk.
The skill advertises live Baidu hot topics, trends, and keyword popularity, but the implementation always returns hardcoded mock data instead of querying a real Baidu source. This is dangerous because downstream users or agents may make decisions based on fabricated or stale information while believing it is current external data.
The user-facing output strings are fixed to Chinese text and the script provides no option to select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
No suspicious patterns detected.
