Security audit
Security checks for vulnerabilities and agentic risk
The skill is a local Chinese-language trend report generator with optional user-directed report output and no hidden network, persistence, or credential behavior found.
Before installing, understand that the included script appears to generate simulated trend data, not live platform analytics. If you extend it to use real APIs or crawlers, review platform terms, rate limits, privacy expectations, and API key handling. Use --output only with a path you are comfortable creating or overwriting.
The skill advertises usage that can write a report file via --output report.md, but it declares no explicit tool scope or permissions. In an agent ecosystem, missing capability boundaries can let the skill perform file-write actions without clear user awareness or policy enforcement, increasing the risk of unintended local file modification.
The trigger phrases like '分析热点', '话题热度', '趋势分析', and '热点报告' are broad, generic requests that could match many ordinary conversations. Overbroad activation can cause the wrong skill to run, unexpectedly initiating scraping, analysis, or file-generating behavior when the user did not intend this specific tool.
The skill description promotes tracking and scraping across Weibo, Douyin, Xiaohongshu, and Bilibili but does not warn users about third-party data collection, scraping, or possible platform ToS/privacy implications. This can lead to uninformed use of external collection mechanisms and expose operators to compliance, privacy, or account-risk issues.
Natural-language instructions and user-facing content throughout the file are presented only in Chinese, with no indication that the skill supports other languages or that Chinese is a deliberate region-specific constraint. This can violate language/locale policy expectations when users are not given an explicit opt-in or alternative.
The usage example shows an output file being written with --output report.md, but the description does not clearly warn users that local files may be created or overwritten. In agent-driven workflows, undisclosed write behavior can surprise users and contribute to accidental data loss or workspace contamination.
This code file contains user-facing natural-language descriptions that assume Chinese as the required language, including the module description and CLI help text elsewhere in the file. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or language choice is provided.
The script prints status messages and exposes command-line help strings in Chinese only, which imposes a single language for user interaction. There is no option to select locale or indication that the tool is intentionally limited to a Chinese-speaking audience.
