Security audit
Security checks for vulnerabilities and agentic risk
The skill is low-privilege, but it presents Product Hunt results as current while its executable script returns hard-coded mock products.
Review this skill carefully before installing if you need real Product Hunt trends. It appears safe from a local-system perspective, but its outputs should be treated as demo or mock data unless the publisher changes the implementation to fetch and label live data clearly.
The skill claims to monitor daily Product Hunt trending products, but the content only shows hardcoded example output and no mechanism for fetching live Product Hunt data. This can mislead users into trusting stale or fabricated results, which is a security-relevant integrity issue even if it is not direct code execution.
The trigger terms include very broad keywords such as 'launch' and '新产品', which can cause the skill to activate in unrelated conversations. Over-broad activation can route user requests to the wrong skill, increasing the chance of misleading output or unintended handling of user queries.
The module docstring and function comments describe a Product Hunt fetcher, but the code only serves simulated data. Misrepresentation of behavior can mislead users, orchestrators, or other components into treating fabricated content as authoritative, creating a data provenance and trust problem.
The skill advertises fetching daily Product Hunt trending products, but the implementation returns hard-coded mock entries. This is a deceptive integrity issue: downstream users or agents may trust the output as current external data and make decisions based on fabricated results.
The skill title and description present the capability primarily as a Chinese-language experience ("热门产品监控") without stating that users may choose their preferred language. This may conflict with language/locale policy expectations unless the locale restriction is intentional and clearly disclosed as optional or region-specific.
The description includes Chinese text alongside English, and the manifest tags also suggest a Chinese-language orientation. Because the file does not indicate that language selection is optional or that the skill is intentionally region- or locale-specific, this may conflict with a policy requiring user opt-in for language/locale constraints.
The script hardcodes Chinese-language strings in the module description, function docstrings, and formatted output, including the main user-facing heading and product taglines. Because there is no option to select language or any documented justification that this skill is intentionally region-specific, this creates a natural-language locale policy concern.
