Security audit
Security checks for vulnerabilities and agentic risk
This skill appears safe to install, but it behaves like a static Chinese-language demo rather than a live IT Home news monitor.
Install only if you are comfortable with a Chinese-focused skill that currently outputs mock/static IT Home-style headlines. It does not appear to access credentials, persist itself, or modify local data, but its trigger wording is broad and its live-news capability is not implemented.
The trigger words include broad terms like “数码” and “科技新闻,” which can overlap with ordinary user conversation and cause the skill to activate unintentionally. This can lead to inappropriate routing of user requests, reduced reliability, and unexpected handling of conversations that were not intended to invoke this skill.
The manifest describes a monitor for IT之家热门资讯, implying retrieval of current trending news. However, get_ithome_hot is explicitly implemented with a fixed in-memory mock_news list and no live source access, so the actual behavior is static demo output rather than news monitoring.
The skill body presents usage and output exclusively in Chinese, which may imply a fixed language/locale behavior. While the top description is bilingual, the operational instructions do not indicate that users may choose another language or that Chinese output is optional.
The manifest text and tags explicitly position the skill as Chinese-focused ("IT之家热门资讯监控" and tag "chinese") without indicating any user choice of language or locale. This can violate language/locale policy when a skill appears to enforce a specific language context by default rather than offering an opt-in or documenting a justified regional restriction.
The script's natural-language content, including the title, docstrings, categories, and formatted output, is primarily in Chinese. Because the file does not offer a user language choice or justify a China-specific locale restriction, it may violate the language/locale policy for broadly usable skills.
The docstring at L11 says '获取IT之家热门（模拟数据）', which partially discloses simulation, but the function name and surrounding module description present it as a real fetcher. The implementation never fetches anything and only slices a hardcoded list, creating intent/documentation ambiguity that contradicts the apparent fetcher semantics.
