Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese short-drama analysis service with an external API and optional Alipay payment flow, and I found no hidden code, persistence, or deceptive behavior.
Install only if you are comfortable sending short-drama titles or keywords to sinodata.io and using a China-focused Alipay payment flow for full reports. Payment is disclosed as 9.90 CNY per full report, and users should confirm they want the paid report before following the payment link.
The trigger description is broad enough to activate on generic requests about analysis, evaluation, or why something is successful, which can cause the wrong skill to be invoked outside its intended short-drama niche. Over-broad routing can lead to confused-deputy behavior, unexpected external API/payment flows, and reduced user control over which capability is being used.
The trigger list is broad enough to match many ordinary conversations about short dramas, script analysis, recommendations, and trending content. This can cause the skill to activate in contexts where the user did not explicitly request this paid external analysis service, increasing the risk of unwanted routing, accidental third-party data disclosure, and inappropriate payment prompts.
The description states "仅限国内用户", which imposes a locale/region restriction in natural language. The file does not offer user opt-in or choice, and the restriction is not explained as a compliance or legal requirement.
The manifest description is entirely in Chinese and pricing is denominated only in CNY/Alipay, which suggests the skill may be limited to a Chinese-language and China-specific locale experience. There is no natural-language statement offering users a language choice or explicitly documenting that the skill is intentionally region-specific.
