✓
Purpose & Capability
Name/description match the provided Python implementation: local templates, emoji suggestions, publish-time tips and interaction prompts. No unrelated environment variables, binaries, or external services are requested; the included code generates outputs entirely locally.
ℹ
Instruction Scope
SKILL.md stays within scope (generate copy given product/scene/style/count). However it explicitly instructs generation strategies like '制造稀缺/制造羡慕/制造焦虑' (create scarcity/jealousy/anxiety), which is ethically manipulative — this is within functional scope but noteworthy. The instructions do not tell the agent to read unrelated files, access env vars, or call external endpoints.
✓
Install Mechanism
No install spec; skill is instruction-only with a single Python file included. There are no download URLs or extract steps. Risk from installation is low, though executing the included Python file will run code on the host (it appears self-contained and does not perform network I/O).
✓
Credentials
No required environment variables, credentials, or config paths are declared or used. The code reads no env vars and contains no network calls or credential access.
✓
Persistence & Privilege
always is false and the skill does not request persistent system privileges or modify other skills. It does not include any autonomous persistence mechanism beyond normal skill behavior.
Scan Findings in Context
[unicode-control-chars] unexpected: SKILL.md contained unicode control characters (scanner-detected). These invisible characters can be used for prompt-injection or to alter how text is interpreted by parsers/agents. This is not expected or necessary for a copy-generator and should be inspected/removed.
What to consider before installing
This skill is mostly coherent and low-risk technically: the Python file is self-contained, there are no network calls or credential requirements, and the SKILL.md instructions align with the stated purpose. However: 1) The SKILL.md flagged for unicode control characters — inspect and remove invisible characters before installing or running, as they can be used for prompt-injection or to hide malicious instructions. 2) Verify the source (homepage unknown) before paying or enabling in production. 3) Consider running the code in a sandbox first to confirm it has no hidden network activity. 4) Be aware the content strategy explicitly promotes manipulative tactics (scarcity/jealousy/anxiety); ensure using the outputs complies with platform rules and your ethical standards. If you see any additional hidden files, unexpected network endpoints, or requests for credentials, treat that as a strong warning and do not install.
