Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent trend-content creation skill, with the main caution that it uses external APIs and user-configured credentials.
Install only if you are comfortable configuring API keys for external trend/search and image-generation services. Use scoped keys where possible, avoid entering private prompts or sensitive reference images, and treat generated social content as something to review before publishing.
The trigger phrases are broad, generic terms such as content-creation and trend-chasing language that could plausibly appear in ordinary conversation. This creates a real risk of unintended activation, causing the agent to begin multi-step external-data and image-generation workflows without the user clearly intending to invoke this specific skill.
The skill explicitly relies on user-configured API keys and multiple external platform/API calls, but it does not warn users that prompts, search queries, topic selections, and possibly generated content metadata may be transmitted to third-party services. In this context, automatic retrieval from several platforms and later image-generation steps increase the chance of unintentional data exposure or misuse of credentials if users do not understand the data flow.
All user-facing instructions, prompts, and fixed output examples are in Chinese, and the skill does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the constraint is explicitly documented and justified.
