Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed sticker-matching helper that fetches a GitHub-hosted sticker index and caches sticker data locally, with no packaged executable code or hidden privilege behavior found.
Before installing, expect the skill to contact a GitHub-hosted sticker repository and keep a local cache so stickers can update without reinstalling. Install it if you are comfortable with that network access and automatic sticker selection in Chinese-language chat contexts; avoid it if you need strict offline operation or explicit per-message approval before sending stickers.
The entire skill description is written in Chinese and the categorization/triggering examples are Chinese-language specific, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
The skill explicitly describes fetching a remote JSON index from GitHub and locally caching indexes and popular stickers based on conversation context, but it does not warn users that network requests and context-derived data may be transmitted or stored. This creates a privacy and trust issue because conversation cues, inferred emotions, and usage patterns can influence remote access and caching behavior without informed user consent.
No suspicious patterns detected.
