Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent writing and image-generation skill, but it needs Review because it can fetch arbitrary URLs and use an under-disclosed local RedFox API key file.
Install only if you are comfortable with the skill making outbound requests to user-provided sites and redfox.hk. Avoid internal/private URLs and confidential unpublished content, use a sandboxed workspace, and remove or disable the ~/.qoder/apis/redfox.json fallback if you want every RedFox API key use to be explicit.
This mismatch suggests the skill markets itself as a full creative pipeline, but the actual code may only cover a limited subfunction such as article validation. While not inherently malicious, this is dangerous because it creates false trust and can cause operators to invoke the skill in broader contexts than warranted, potentially exposing data or relying on nonexistent safeguards.
This mismatch suggests the skill markets itself as a full creative pipeline, but the actual code may only cover a limited subfunction such as article validation. While not inherently malicious, this is dangerous because it creates false trust and can cause operators to invoke the skill in broader contexts than warranted, potentially exposing data or relying on nonexistent safeguards.
This mismatch suggests the skill markets itself as a full creative pipeline, but the actual code may only cover a limited subfunction such as article validation. While not inherently malicious, this is dangerous because it creates false trust and can cause operators to invoke the skill in broader contexts than warranted, potentially exposing data or relying on nonexistent safeguards.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if len(prompt) + len(suffix) > MAX_PROMPT_LENGTH:
available = MAX_PROMPT_LENGTH - len(suffix) - 3
prompt = prompt[:available] + "..."
return prompt + suffix
# reference / none：原样返回
return prompt
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if len(prompt) + len(suffix) > MAX_PROMPT_LENGTH:
available = MAX_PROMPT_LENGTH - len(suffix) - 3
prompt = prompt[:available] + "..."
return prompt + suffix
# reference / none：原样返回
return prompt
The link rewrite feature states it will 'automatically fetch' article content and images from any provided link, but the README does not prominently warn users that this initiates outbound network requests and ingests third-party content. In an agent skill, that omission can lead to unexpected data disclosure, access to untrusted remote content, and misuse in contexts where external fetching should be deliberate and consented to.
The README encourages broad natural-language triggering ('Simply describe your needs in natural language') across multiple high-impact actions, including external fetching, promotion generation, and file-writing behavior. This can cause accidental invocation of capabilities the user did not explicitly intend, especially in agentic environments where nearby conversational text may be interpreted as a command.
The README states that the skill will automatically fetch article content/images and retrieve latest information from target sites, but it does not clearly warn users when network requests occur or what data may be transmitted externally. In a skill that processes URLs, article text, and skill paths/names, this can lead to unanticipated data disclosure, privacy issues, or SSRF-like misuse if arbitrary URLs or internal resources are accepted.
The README says users can 'directly use natural language to describe needs' and then provides broad example phrases like '帮我给这个 Skill 写一篇推广文' and '帮我给这篇正文加上配图'. It does not define explicit trigger boundaries, exclusions, or when the skill should not activate, which makes the activation scope ambiguous for a markdown skill description.
The skill advertises and references capabilities that imply environment access, file read/write, and network use, but it does not declare any explicit tool scope or permissions boundaries. This is dangerous because users and hosting agents cannot clearly constrain what the skill may access, increasing the risk of unintended data exposure, remote fetching, and filesystem modification during normal-looking content workflows.
The trigger phrases are broad and overlap with ordinary writing requests, which can cause the skill to activate in contexts where the user did not intend to permit network fetching, file writes, or third-party content processing. In an agent environment, ambiguous invocation increases the chance of accidental execution of higher-risk behaviors behind routine prompts.
The skill describes link rewriting that fetches third-party article content and images, but it does not present a clear warning to users that external content will be retrieved and processed. This is dangerous because users may unknowingly trigger collection of remote material, with implications for privacy, compliance, copyright handling, and unexpected network activity.
The skill requests an image-generation API key but does not explicitly warn that prompts, article text, or image instructions may be sent to an external image-generation service. This creates a data-handling transparency issue: users may include confidential product details or unpublished content that is then transmitted off-platform without clear consent.
The file title and all prompt templates are written as direct Chinese-language instructions, such as '你正在写一篇…运营文章', which effectively constrains outputs to Chinese. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regional context.
In skill_promo mode, the workflow instructs the agent to read local/remote skill content and then visit a user-supplied targetSiteUrl to fetch the latest skills list and feature data. This expands the skill from article generation into network retrieval and broad external content collection, which can enable unintended data access, privacy issues, or SSRF-like behavior if URL targets are insufficiently constrained.
The workflow hard-codes image prompts as Chinese in the command template, indicating a mandated language choice rather than letting the user select locale. This is a natural-language policy concern because the file does not offer any language preference or opt-in mechanism, and the document overall is framed entirely around Chinese output conventions.
This markdown file presents all operational guidance exclusively in Chinese, which can constitute a language-policy violation when no user opt-in or locale justification is provided. The content does not indicate that the skill is region-specific or that users may choose another language.
The entire skill specification, trigger descriptions, output explanations, and operational guidance are written solely in Chinese, with no indication that users may choose another language or locale. This creates a natural-language policy issue if the skill is expected to support general users, because it effectively constrains use to a single language without opt-in or justification.
在 Case 4 中，文档写明“当前默认输出中文新文章（v2 默认）”，即使输入原文是英文，也只有在用户额外提出时才保持英文。这属于默认强制特定语言/locale 的行为，缺少用户显式 opt-in，不符合语言选择应由用户决定的要求。
The document title and all instructional content are written in Chinese, and the configuration labels and examples assume Chinese-language usage throughout. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or China-specific context, which creates a natural-language locale policy concern.
This markdown file repeatedly requires Chinese-only text in generated outputs, such as '居中大号加粗中文主标题' and '所有中文文字工整清晰'. Because the file provides mandatory language constraints but no user opt-in or explanation that the skill is region-specific, it conflicts with the policy against forcing a specific language or locale.
The popcomic template requires a Chinese title and Chinese text rendering, and presents that requirement as part of the default template behavior. Since no language selection mechanism or justification is provided, this is another natural-language policy violation affecting users who may expect locale flexibility.
This section requires Chinese titles and Chinese in dialogue bubbles as a fixed constraint. Enforcing one language across the template set without user opt-in or a documented regional scope violates the stated language/locale policy.
This markdown file contains a natural-language style rule that explicitly requires one pronoun/register choice: '用「你」不用「您」'. That enforces a specific language/register convention without any opt-in or alternative, which fits the language/locale policy violation category.
This code file’s natural-language documentation and CLI/help text are written entirely in Chinese and describe behavior specifically for Chinese text processing, without offering a language choice or documenting that the tool is intentionally locale-specific. Under the policy rule, forcing a specific language/locale without opt-in is a natural-language policy violation.