Security audit
Security checks for vulnerabilities and agentic risk
Forum Scout is a disclosed forum-monitoring helper that uses a Moltbook API token and local reports/logs, with no artifact evidence of hidden execution, exfiltration, or destructive behavior.
Before installing, verify that you intend to give the skill a Moltbook API key, allow periodic forum reads, and keep local reports/receipts under ~/.forum-scout/. Check how to disable scheduled scans and clean stored logs if those artifacts may contain sensitive forum data.
SQP-3 applies to all file types and includes language or locale policy violations. The skill documentation is presented entirely in Chinese for user-facing instructions, while no opt-in, alternative language option, or justification for a Chinese-only locale is provided.
The description advertises autonomous browsing, filtering, logging, and report generation across a forum without defining user-triggered boundaries, scope limits, or safety constraints. In a shell-runtime skill, this ambiguity increases the chance of overbroad automation, unintended data collection, or actions occurring without sufficiently explicit user consent.
The skill advertises automated forum scanning, use of a Bearer token, and storage under ~/.forum-scout/, but it does not clearly warn users up front that it will perform external network requests on a schedule and persist logs/data to local disk. This creates a transparency and consent problem: users may invoke or install it without realizing it will contact third-party services and leave potentially sensitive artifacts behind.
The manifest description is written entirely in Chinese, which indicates a fixed language/locale expectation without any stated opt-in, alternative language support, or region-specific justification. This can violate language/locale policy when a skill implicitly constrains interaction language without user choice.
No suspicious patterns detected.
