Security audit
Security checks for vulnerabilities and agentic risk
This skill is a low-risk Weibo hot-topics helper, but it appears to provide mock/demo data rather than the live monitoring and analysis it advertises.
Install only if you are comfortable treating this as a Chinese-language demo/helper for Weibo hot topics. Do not rely on its output as live Weibo data, sentiment analysis, or alerting unless the publisher adds real data retrieval and clearly labels freshness and source behavior.
The skill claims live monitoring, popularity tracking, and sentiment/public-opinion analysis, but the content only shows static examples and even states that mock data may be used when the API is unavailable. This mismatch can mislead downstream agents or users into making decisions based on fabricated or unverified data, which is especially risky for monitoring and analysis workflows.
The skill advertises behavior that implies network access to fetch Weibo hot topics, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can allow broader-than-expected tool use or make reviewers and users unable to verify what external access the skill is supposed to have.
The trigger phrases include very broad terms such as '微博', '热搜', 'weibo', and 'hot', which can cause the skill to activate in unrelated conversations. Overbroad activation increases the chance of unintended execution, context hijacking, or incorrect delegation to a skill that may provide mock or mismatched results.
The manifest describes a monitor that can get Weibo trending topics, topic popularity, and sentiment analysis. In this file, the code only serves a predefined mock ranking list and formats it for output; it performs no sentiment analysis and no real analysis logic on topic popularity beyond echoing hardcoded 'hot' values.
Most of the skill instructions, examples, and output format are written only in Chinese, and the file does not state that users may choose their preferred language for responses. While the description includes some bilingual text, the operational guidance does not clearly offer opt-in language selection.
This code includes user-facing natural language strings and comments in Chinese, including the formatted output header, but provides no opt-in or alternative language selection. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
