Social Sentiment Monitor 社交舆情监控

Key things to consider before installing or running this skill: - Billing and hidden charges: The skill advertises pay‑per‑call billing and includes payment code that contacts skillpay.me. The code contains a hardcoded billing API key in payment.py. This could enable remote billing/charge operations; do not run this on an account or machine you cannot revoke access to. Ask the publisher how payments are enforced, whether the hardcoded key is theirs or leaked, and whether you can opt out. - Incoherent capability: Despite claiming live monitoring of Twitter/Reddit/Telegram/Discord, the provided scripts largely generate simulated data and demos. If you expect real data, verify which modules actually call real APIs and whether you must supply OAuth keys—do not assume real integrations are present just because the docs show API examples. - Missing declared env vars: The skill's manifest lists no required environment variables, but config examples reference many credentials (Twitter, Reddit, LunarCrush, Santiment, TELEGRAM_BOT_TOKEN, DISCORD_WEBHOOK_URL). Treat that as a red flag: confirm required env vars before running, and never put real production credentials into untrusted code. - Run in a sandbox first: If you still want to test it, run the skill in an isolated environment (container/VM) with no sensitive credentials, and monitor network traffic to see what external endpoints it contacts (especially skillpay.me). - Code hygiene: Prefer vendors that require API keys via environment variables (not hardcoded), document exact billing behaviour, and provide a verifiable homepage/source. If you plan to use it in production, request the publisher remove any embedded secrets, add explicit required env declarations, and clarify whether the scripts will hit real social APIs or only simulate data. If you are unsure or the publisher cannot explain the hardcoded key and billing flow, do not install or run this skill with real credentials or on sensitive systems.