Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public trending-topic lists from Weibo, Douyin, and Baidu, with no evidence of hidden persistence, credential access, destructive behavior, or data exfiltration.
Install this if you are comfortable with a skill that makes live requests to Weibo, Douyin, and Baidu and returns Chinese-oriented summaries. Be aware that the package does not declare all Python library dependencies in metadata, so the runtime environment may need curl_cffi and lxml available.
The skill invokes a Python script that fetches live trending data from external platforms, which implies network access, but the manifest does not declare any tool scope or permissions boundary. This weakens least-privilege controls and makes it harder for a host agent to govern or audit outbound connectivity, increasing risk if the script is modified or behaves unexpectedly.
The markdown explicitly instructs the agent to render results strictly using a Chinese-language template. This imposes a specific language/locale on users without offering a choice or documenting a justified region-specific constraint, which matches the policy-violation criteria.
The module docstring is written as a Chinese-only user-facing description ("微博 / 抖音 / 百度 热搜一键拉取"), and the CLI help text elsewhere is also Chinese-only. This indicates a language constraint without any opt-in, language selection, or documented justification such as a region-specific compliance scope.
No suspicious patterns detected.
