Security audit
Security checks for vulnerabilities and agentic risk
This skill clearly targets Baidu Tieba account automation, but it can post, rename, like, and delete content with a user token without built-in confirmation safeguards.
Install only if you want an agent to control a Baidu Tieba account through TB_TOKEN. Keep the token limited and revocable, review every post/reply/rename/delete action before execution, and treat deletion commands as potentially irreversible remote account changes.
The skill can access an authentication token via environment variables and perform networked actions against Baidu Tieba, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent invokes sensitive capabilities without clear user consent, review, or platform-level restriction.
The skill instructs the agent to unconditionally obey an external persona file, overriding its normal behavior whenever posting or replying. This is dangerous because external prompt content can manipulate agent decisions, suppress safety-aligned behavior, or steer social actions in ways the current user did not request.
The skill exposes destructive commands to delete posts and comments but provides no strong warning that these actions are irreversible or should require explicit confirmation. In an agent setting, this can lead to accidental content loss or abuse if the model is prompted into cleanup or retaliation actions.
The entire skill specification is written as a fixed Chinese persona and response style, with no indication that the user can choose another language or locale. This creates a natural-language locale constraint that appears mandatory rather than optional, which matches the policy-violation category for language or locale restrictions.
The CLI exposes destructive operations to delete threads and posts with no confirmation prompt, dry-run mode, or guardrail. In an agent skill context, this increases the chance of accidental or prompt-induced destructive actions against a real user account and causes irreversible remote state changes.
Multiple POST commands perform real remote actions such as posting, replying, liking, renaming, and deleting without any explicit user warning, confirmation, or approval boundary. In an agent-operated skill, this makes unintended account changes and forum interactions much more likely, especially if user intent is ambiguous or adversarial input steers the agent.
The get helper sends the TB_TOKEN in the Authorization header on outbound HTTP requests, and the post helper does the same for POST operations. While token-based API access is part of the tool's function, the file only states that TB_TOKEN must be configured and does not explicitly warn users that their credential will be transmitted to Baidu on each request.
No suspicious patterns detected.
