Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple social-copy generator that sends the provided topic and style request to wsdsocial.com, with no hidden local access, persistence, or unrelated behavior found.
Install only if you are comfortable sending the topic and style instructions you provide to wsdsocial.com using your WSD_API_KEY. Avoid submitting secrets, private launch plans, personal data, or confidential client material, and be mindful that generic copywriting prompts may match this skill unless you choose skills deliberately.
The trigger keywords are broad enough to match generic writing and copywriting requests, which can cause the agent to invoke this skill in situations where users did not intend to send their prompt to a third-party service. Because the skill forwards user-supplied topic content externally, overbroad activation increases the risk of unintended data disclosure and confusing or unsafe routing.
The usage instructions show that user-provided content is posted to an external API but do not clearly warn users that their topic and request text leave the local system and are processed by a third party. This omission can lead to accidental exposure of sensitive business, personal, or unpublished marketing content.
The skill explicitly sends user-controlled content to an external domain, which is a real data egress path. In this skill's context, the transmission is expected functionality, but it remains security-relevant because prompts may contain sensitive marketing plans, proprietary product information, or personal data if users are not warned and consent is not obtained.
curl -X POST "https://ai.wsdsocial.com/api/pub/skills/red-note-generator/_tool_86" \
-H "Content-Type: application/json" \
-H "key: ${WSD_API_KEY}" \
-d '{
The description mixes Chinese trigger terms such as "种草文案" and "笔记生成" and appears oriented toward Xiaohongshu-style content, but it does not explicitly state whether output language is fixed, selectable, or region-specific. This can create a locale-policy concern if the skill assumes a particular language or platform style without user opt-in.
No suspicious patterns detected.