Security audit
Security checks for vulnerabilities and agentic risk
This markdown-only skill fetches public trending topics, drafts social content, and archives outputs locally, with no hidden code or privileged behavior found.
Install only if you are comfortable with the agent contacting public trend platforms and saving fetched trends or generated drafts into a local hotspot archive. For quick one-off writing tasks, specify whether you want trend fetching, monitoring, and archiving enabled.
The skill description is broad enough to match common user requests like '写文案' or '追热点', which can cause over-triggering and unintended activation. In an agent environment, ambiguous routing increases the chance the skill will run when the user did not intend web scraping, monitoring, or file-writing behavior, potentially causing unnecessary external requests and local data persistence.
The description advertises automatic archiving but does not clearly warn that fetched data and generated copy will be written to local files. Users may invoke the skill for a quick lookup or draft without realizing persistent storage occurs, which creates confidentiality, retention, and workspace hygiene risks.
The examples combine monitoring and content generation requests without stating approval boundaries, duration limits, or when the skill should not activate. This can lead an agent to initiate repeated monitoring or broad content actions from casual prompts, expanding the operational scope beyond what the user clearly authorized.
The installation note says network access is required but does not inform users that prompts may cause requests to external platforms such as Weibo, Zhihu, or Douyin. This lack of transparency can expose user interests or operational metadata to third parties and may violate expectations in restricted environments.
No suspicious patterns detected.
