Zsxq User

知识星球用户信息：查看当前登录用户的个人资料、查询跨星球的最近发主题足迹。当用户需要查看自己的用户 ID、昵称、头像、认证状态，或查看自己最近在各星球发过的主题时使用。

Security Scan

The skill's declared purpose (view current user profile and cross-group footprints) matches its instructions, but there are metadata inconsistencies and an undeclared dependency on a shared auth document that require review before installing.

Purpose & Capability

The skill's name/description (view current user info and cross-group footprints) aligns with the instructions to call zsxq-cli user +info and +footprints. However, SKILL.md declares a required binary (zsxq-cli) in metadata while the registry metadata above lists no required binaries — this mismatch should be resolved.

Instruction Scope

Runtime instructions are narrow and CLI-focused (run zsxq-cli user +info / +footprints). They explicitly require the agent to READ ../zsxq-shared/SKILL.md first for authentication/error rules. Reading that shared SKILL.md is reasonable for auth guidance, but it introduces dependence on another skill's contents (and potentially on where credentials are stored). The instructions do not ask the agent to read arbitrary system files or exfiltrate data.

Install Mechanism

This is an instruction-only skill with no install spec and no code files — it does not write code to disk or download artifacts, which is low risk. The only runtime requirement is the external CLI binary (zsxq-cli) referenced in SKILL.md.

Credentials

No environment variables, credentials, or config paths are declared in the registry metadata, yet the skill depends on authentication (handled via the referenced zsxq-shared/SKILL.md) and on the zsxq-cli binary. The skill does not declare where or how credentials are provided; that gap is concerning because the shared doc may reference environment variables or stored tokens not disclosed here.

Persistence & Privilege

always is false and the skill is user-invocable. It does not request persistent system presence or attempt to modify other skills. The only elevated action is reading the shared SKILL.md for auth rules, which is within scope but should be reviewed.

What to consider before installing

Before installing or enabling this skill: (1) Inspect the referenced ../zsxq-shared/SKILL.md to see exactly how authentication works and where credentials/tokens are stored or read from; confirm it does not instruct the agent to read unrelated files or environment variables. (2) Verify the zsxq-cli binary is trustworthy (where it comes from) and that the registry metadata correctly lists it as a requirement. (3) Confirm there are no hidden endpoints or instructions in zsxq-shared that would transmit your credentials to an unexpected server. (4) If you cannot review zsxq-shared, treat this skill as higher risk and avoid granting it autonomous invocation until the auth details are clear.

user (v1)

CRITICAL — 开始前 MUST 先用 Read 工具读取 ../zsxq-shared/SKILL.md，其中包含认证、错误处理规则。

Core Concepts

• 用户（User）：当前已登录的知识星球账户，由 user_id（纯数字）唯一标识。user_id 在 group +list、搜索成员等操作中被用作参数。

Shortcuts（推荐优先使用）

Shortcut	说明
+info	查看当前登录用户的完整个人资料，含 user_id、昵称、认证状态
+footprints	查看自己在所有星球发过的主题（跨星球足迹），支持分页

API（通过 zsxq-cli api call 直接调用）

工具	参数	说明
search_group_members	group_id, keyword, limit	在星球内按昵称搜索成员，获取其 user_id