Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a disclosed market-scanning tool, but one scraper reuses a logged-in admin browser session and extracts an Admin-Token to query backend management APIs.
Install only if you intentionally want a Chinese short-fiction market-scanning workflow and are authorized to use any logged-in Heiyan admin account involved. Avoid running the Heiyan scraper in shared browsers or with broad admin accounts; prefer public pages or user-provided exports where possible, and review output files before copying them into other projects.
The skill references use of a logged-in author/admin backend and Admin-Token-authenticated internal management APIs to pull book list/detail data, which goes beyond benign public trend analysis. Accessing internal or management endpoints via an existing login session can expose non-public data and effectively turns the skill into a data-exfiltration or privileged harvesting workflow if misused.
The skill references use of a logged-in author/admin backend and Admin-Token-authenticated internal management APIs to pull book list/detail data, which goes beyond benign public trend analysis. Accessing internal or management endpoints via an existing login session can expose non-public data and effectively turns the skill into a data-exfiltration or privileged harvesting workflow if misused.
Referenced artifact was not completely inspected
3. 聚合：`node scripts/aggregate-rank.js {输出目录} --out {输出目录}/扫榜聚合.md --sparse 10 --scale short`。**主会话只读这份聚合**，要看开头与人设原文再抽样：`node scripts/aggregate-rank.js {输出目录} -
Referenced artifact was not completely inspected
3. 聚合：`node scripts/aggregate-rank.js {输出目录} --out {输出目录}/扫榜聚合.md --sparse 10 --scale short`。**主会话只读这份聚合**，要看开头与人设原文再抽样：`node scripts/aggregate-rank.js {输出目录} -
Referenced artifact was not completely inspected
| [scripts/dz-browse-scraper.js](scripts/dz-browse-scraper.js) | 点众短篇采集（男频/女频），用法见点众参考 |
Referenced artifact was not completely inspected
| [scripts/heiyan-booklist-scraper.js](scripts/heiyan-booklist-scraper.js) | 黑岩书库列表采集（需登录），用法见黑岩参考 |
The script explicitly requires a human to log into an admin backend, then uses that authenticated context to access management APIs for data extraction. That exceeds the declared purpose of generic trend analysis and creates a privileged-data access path that depends on reused admin credentials, which is dangerous if the skill is run in shared or loosely governed environments.
The code reads an Admin-Token from browser cookies and repurposes it as a Bearer token for direct backend API calls. This is a credential-harvesting and session-reuse pattern: it bypasses normal user-mediated access controls, expands the blast radius of a browser login session, and could expose privileged administrative data or enable unauthorized API use if reused elsewhere.
The skill instructs the agent to use networked scraping, browser/CDP automation, local file writes, and script execution, but it does not declare an explicit tool/permission scope. That creates overbroad authority and makes it easier for the skill to access external sites, local environment state, or authenticated browser sessions without clear user-visible constraints.
The trigger phrases include broad, natural-language expressions that may activate the skill unintentionally during ordinary conversation. Accidental invocation matters more here because the skill is capable of network/browser scraping and local file operations, so a false trigger could kick off data collection without the user's informed intent.
The document instructs the operator to log into a site in Chrome and then have a script extract a Bearer token from browser cookies to call backend APIs. Even if intended for legitimate scraping, handling authentication tokens this way creates credential exposure risk and enables reuse of a privileged session without clear consent, scope limits, or privacy/security warnings.
This markdown file contains natural-language instructions and reference material exclusively in Chinese, and there is no indication that users can opt into this language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
The document instructs the skill to write conclusions into a persistent markdown file and later rely on that file for subsequent workflow steps, but it does not warn users that data will be stored on disk or that re-runs may replace existing content. This creates a real transparency and integrity issue: users may unintentionally persist sensitive project notes or lose prior conclusions through overwrite behavior.
The manifest describes analyzing hot short-story data across multiple platforms such as 知乎盐言、七猫、黑岩、点众 to capture topic trends. In this file, the code is narrowly scoped to 点众阅读, visits only ishugui browse URLs, extracts book-card fields, and writes a Markdown report; there is no cross-platform aggregation or trend analysis here.
The request body always sets language:'zh_TW', which forces a specific locale for fetched data. The file does not offer a user opt-in or configuration choice, and the surrounding comments do not justify this as a region-specific requirement.
The delivery instructions tell users to copy 短篇扫榜结论.md into the project root so another command can auto-discover it, but they do not warn about possible name collisions, replacement of an existing file, or accidental exposure of internal planning data in a broader project directory. In context this is not overtly malicious, but it can still lead to unintended file overwrite or persistence in a sensitive location.
This code file contains natural-language instructions, comments, and console-facing usage guidance exclusively in Chinese. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language or locale choice is offered.
Detected: suspicious.dangerous_exec