Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only guide for building China-focused notification integrations, and its external API examples are disclosed and aligned with that purpose.
Use this skill only for intended notification integrations. Protect provider credentials, use approved templates, record user consent where required, enforce rate limits, avoid sensitive personal data in messages, and test with sandbox accounts before production sends.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const accessToken = await getAccessToken()
const result = await axios.post(
`https://api.weixin.qq.com/cgi-bin/message/template/send?access_token=${accessToken}`,
{
touser: openid,
template_id: templateId,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const accessToken = await getAccessToken()
const result = await axios.post(
`https://api.weixin.qq.com/cgi-bin/message/template/send?access_token=${accessToken}`,
{
touser: openid,
template_id: templateId,
The Feishu bot example hard-codes the locale key zh_cn, which constrains output to Simplified Chinese. The file does not indicate that language selection is optional or configurable, so this reads as a fixed locale choice rather than a user-selected one.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Safety Rules
1. **Never send marketing SMS without consent** — PIPL requirement
2. **Always check rate limits** — exceeding limits gets your account suspended
3. **Template approval first** — WeChat and SMS templates must be pre-approved
4. **Fallback channels** — if primary channel fails, try secondary
No suspicious patterns detected.