Security audit
Security checks for vulnerabilities and agentic risk
The skill largely does what it claims, but it should be reviewed because it sends user content to remote APIs and has unsafe script argument handling.
Install only if you are comfortable sending checked content to the listed remote API service. Avoid using it on confidential drafts, regulated business plans, or client material unless you have reviewed the provider's data handling. The publisher should add explicit send-to-remote consent, document retention/privacy terms, narrow activation triggers, and fix the shell/Python argument handling before this is treated as low-risk.
The trigger list includes broad terms such as SEO tool, Chinese SEO, compliance API, and predict API, which can cause the skill to activate for loosely related requests outside its narrow purpose. Over-broad activation can route unrelated user content into this skill's network-backed workflow, leading to unnecessary external transmission or inappropriate instructions being applied.
The script sends the full user-provided text, title, and keywords to a third-party remote API, but it gives no explicit privacy notice or consent prompt at the point of transmission. In a compliance-checking tool, users may paste unpublished marketing copy or sensitive business content, so silent exfiltration to an external service creates a real confidentiality and data-governance risk.
The script transmits user-supplied content to a third-party remote API endpoint for prediction, but the CLI gives no explicit warning, consent prompt, or privacy notice before sending potentially sensitive marketing copy. In this skill context, users may paste unpublished campaign text, brand plans, or regulated content, so silent exfiltration to an external service creates a real confidentiality and compliance risk.
No suspicious patterns detected.
