Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese-language Douyin AI script-writing helper with disclosed web-search and file-output behavior, but users should review its viral-content style and output location.
Install this if you want a Chinese Douyin-oriented AI script generator. Before using it, confirm where generated scripts will be saved, avoid overwriting project files, and review outputs for factual accuracy, platform compliance, and non-manipulative tone.
声明描述的是一个完整的抖音AI视频脚本生成技能，包含热点获取、脚本生成和评分等核心能力。但实际代码只是一个非常简单的入口脚本：不进行网络请求，不生成任何视频脚本，不做评分，只打印一条提示让外部工具search_web去搜索热点。虽然“AI热点搜索”与声明中的一部分相关，但实现范围远小于描述，且技能的主要能力并未在代码中体现，因此属于明显的描述与行为不匹配。
The skill instructs saving generated scripts to the project root without explicit user consent, path disclosure, or safety constraints. Unannounced file creation can overwrite existing files, leak sensitive generated content into shared workspaces, or cause unintended persistence in environments where writes have side effects.
This scenario again specifies saving generated output after scoring, but omits any explicit warning that files will be written. Repeated undocumented write behavior increases the chance of unintended persistence, repository pollution, or accidental exposure of generated content in shared or version-controlled directories.
This section explicitly recommends a 'fear-driven viral script template' that centers on制造行业焦虑, 强化焦虑, and framing the user's 生存危机 to increase engagement. In a content-generation skill, that guidance can be operationalized at scale into manipulative persuasive outputs that exploit user anxiety without safeguards, making the finding a genuine safety issue rather than a purely descriptive reference.
The skill describes automatic web searching for AI trends without informing the user that a network request will be made. In agent environments, silent external queries can expose user intent, trigger compliance concerns, or violate expectations in restricted or privacy-sensitive contexts.
The file's natural-language strings and instructions are entirely in Chinese, including the user-facing message directing how to use the skill. This can violate language/locale policy when a specific language is imposed without offering the user a choice or documenting a justified locale constraint.
