Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only analytics skill for public social-media data, with no code execution or persistence, though users should understand it relies on an external API key and data service.
Install only if you are comfortable using the provider's XHS_API_KEY service for social-media analytics. Avoid submitting confidential plans, secrets, or personal data unless you have approval, and treat the platform algorithm formulas and benchmark numbers as advisory rather than guaranteed facts.
The README says users can 'directly describe your problem' and that the Skill will 'automatically fetch relevant data,' but it does not define clear trigger boundaries, supported inputs, or restrictions. Overly broad activation increases the chance the skill is invoked on unintended requests and causes unnecessary external data handling or analysis on sensitive user prompts.
The README mentions an external API key but does not clearly warn that user queries and possibly attached business data will be sent to a third-party API provider. This lack of disclosure can lead users to unknowingly transmit proprietary marketing plans, competitor research, or personal data to an external service, creating privacy, confidentiality, and compliance risks.
The trigger conditions are broad enough to match many generic social-media analysis or运营 requests, which can cause the skill to activate outside its intended scope. This creates routing ambiguity and may override more appropriate skills, increasing the chance of irrelevant guidance, policy bypass through misrouting, or degraded user outcomes.
Mandating Chinese-only output without user choice can cause unsafe or incorrect handling when the user's preferred language differs, especially in multilingual environments where instructions or analysis details may be misunderstood. While not a direct code-execution risk, it reduces usability and can contribute to miscommunication or inappropriate skill selection.
This markdown file presents all user-facing API documentation in Chinese and does not offer an alternative language or note that the skill is region/language-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The title and entire reference content are presented exclusively in Chinese, indicating a fixed language/locale. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
No suspicious patterns detected.
