Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches Baidu hot-search data with a simple disclosed curl request and does not show credential access, persistence, destructive behavior, or hidden execution.
Install only if you are comfortable with the skill contacting Baidu when invoked. Prefer explicit invocations like baidu-hot or 百度热搜榜 to avoid accidental activation from broad words such as 百度 or 热搜.
The trigger list includes very broad terms such as "百度" and "热搜", which are common in normal conversation and can cause the skill to activate unintentionally. This increases the chance of surprise execution and unintended live network access, especially in multilingual chat contexts where these terms may appear frequently.
The description embeds trigger words including very broad terms such as "百度" and "热搜," which are common in ordinary Chinese conversation and can cause the skill to activate unintentionally. While this does not indicate malicious behavior, broad activation increases the chance of unwanted invocation, context hijacking, or accidental data/tool use when a user is discussing related topics rather than explicitly requesting the skill.
The skill documentation shows that it performs a live curl request to a Baidu endpoint but does not clearly warn users that invoking the skill will make an external network request. This can surprise users, leak metadata such as IP/device timing to a third party, and combine with broad triggers to increase unintended outbound traffic.
No suspicious patterns detected.
