Security audit
Security checks for vulnerabilities and agentic risk
This is a legitimate WeChat/LivePage publishing helper, but it uploads chosen content to a third-party service and can enable sharing, analytics, feedback, and form collection.
Before installing, make sure you trust the LivePage/24haowan service and only publish artifacts you are comfortable uploading there. Confirm the target content, visibility setting, passcode/public access, replay/engagement tracking, forms, and any payment QR details before sharing a link.
The trigger description is very broad and includes common phrases like 'give me a link' and 'who read it', which can match many unrelated user requests. That increases the chance the agent invokes this skill in the wrong context, leading to unintended publishing, sharing, or exposure of user content to an external service.
The body adds more vague activation phrases such as 'save this', 'make it one page', and 'generate a link for others', again without strong disambiguation. In a skill that uploads content and manages sharing, ambiguous activation can cause accidental data transfer, privacy violations, or unexpected use of third-party publishing infrastructure.
The natural-language instructions and all user-facing phrasing in the skill are written entirely in Chinese, with no indication that the user may choose another language. This can violate language/locale policy when a skill implicitly constrains interaction language without opt-in or documented justification.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
No suspicious patterns detected.
