Pitch Amplifier

Turn a vague reporting clue, observation, or topic hunch into a deeper news pitch by extracting entities, retrieving 1-2 hop context from a city knowledge gr...

Security Scan

The skill largely does what it claims (turn clues into pitch memos using a local city knowledge graph), but the bundled script expects and uses environment keys and local project files that the skill metadata and SKILL.md do not declare — this mismatch and the script's filesystem access are worth caution.

Purpose & Capability

The name/description (pitch amplification over a city knowledge graph) matches the script's behavior: entity extraction, graph lookup, and LLM-backed memo generation. However, the script expects a local project layout (projects/city-knowledge-graph, a core module graph_db, and a SQLite graph DB) that is not documented in the skill metadata or SKILL.md. The metadata also lists no required env vars even though the script optionally reads OPENAI_API_KEY/GLM_API_KEY and model env vars. These undocumented dependencies on local data and keys are disproportionate to the presented install/requirements information.

Instruction Scope

SKILL.md instructs the agent to run the provided script and describes the high-level workflow. The script, however, reads a local SQLite graph database and imports a core module from a PROJECT_ROOT path outside the script directory; SKILL.md does not say where that data comes from or what files will be read. The script will call an LLM endpoint if API keys are present. The instructions do not document these filesystem or network side-effects, which is scope creep from what the prose describes.

Install Mechanism

There is no install spec (instruction-only), which means nothing is written or downloaded during install. But the packaged Python script requires runtime dependencies (networkx, openai client) and a local project layout; those dependencies are not declared. This is an operational risk (runtime failures) and a transparency gap, but the install mechanism itself does not pull arbitrary remote code.

Credentials

Registry metadata lists no required environment variables, yet the script looks for OPENAI_API_KEY or GLM_API_KEY and optional model variables (PITCH_AMPLIFIER_MODEL / OPENAI_MODEL). It will send user text to an LLM endpoint if a key is present. The script also reads a local SQLite DB under a projects path (potentially outside the skill), which could expose local data. Missing declarations of these env vars and required local config paths are disproportionate and reduce transparency about what secrets or files may be used.

Persistence & Privilege

The skill is not marked always:true and does not request to modify other skills or global agent settings. It does not attempt to persist credentials or reconfigure the environment in the provided files. No elevated persistence behavior was detected.

What to consider before installing

Before installing or running this skill: 1) Inspect or locate the expected projects/city-knowledge-graph directory and the graph_db/core module the script imports — verify the SQLite DB (projects/.../graph_db/city_graph.db) does not contain sensitive data you don't want read. 2) Be aware the script will call an LLM if you set OPENAI_API_KEY or GLM_API_KEY; only provide keys you trust and consider running without keys to avoid network calls. 3) Ensure Python dependencies (networkx, openai client) are installed in a controlled environment; run the script in an isolated VM/container if you want to limit file access. 4) Because metadata and SKILL.md omit the env vars and filesystem requirements, treat this skill as not fully documented — review the bundled graph_db core code (and any project data) to confirm there is no unexpected exfiltration or side-effect. 5) If you need higher assurance, request the author to declare required env vars, provide the graph dataset or document where it comes from, or run a code audit of graph_db and the rest of the project.

Use the bundled script to turn a rough clue into a deeper reporting plan.

Workflow

1. Normalize the user's clue into graph-query keywords.
2. Retrieve nearby issues, institutions, and relation chains from the graph.
3. Generate an editor-style pitch memo with:
   • 图谱关联洞察
   • 破局角度
   • 建议采访清单
4. If the graph has weak coverage, say so clearly and treat it as a reporting gap instead of pretending certainty.

Use the script

Primary script:

• scripts/skill_pitch_amplifier.py

Typical usage:

python3 scripts/skill_pitch_amplifier.py "最近园博园挺热闹，但我感觉大型活动越来越多，周边交通和承载压力可能会越来越大，这个选题能怎么做深？"

Interactive mode:

python3 scripts/skill_pitch_amplifier.py

Constraints

• Prefer graph-grounded output over generic feature writing.
• Do not hard-code one topic template across all topics.
• When graph recall is weak, explicitly mark the topic as a graph blind spot.
• Keep interview lists specific to the detected issue cluster: transport, ecology, governance, operations, market, etc.

Topic routing rule

Infer the dominant issue family from graph context before generating the memo:

• Transport / crowding / parking / carrying capacity
• Ecology / wetland / habitat / environmental protection
• Cultural tourism / event operations / post-event sustainability
• Governance / multi-department coordination / responsibility structure
• Market / business survival / operator pressure

If multiple families appear, keep 2-3 strongest ones and organize the memo around tension between them.