Security audit
Security checks for vulnerabilities and agentic risk
This WeRead skill is purpose-aligned and clearly discloses its API key, network, private reading-data access, and export behavior.
Install only if you are comfortable giving the skill a WeRead API key and allowing it to read your WeRead shelf, reading stats, highlights, and personal thoughts. Confirm each data fetch/export carefully, especially cross-book analysis or Markdown/HTML exports that may contain private notes.
The script’s description, prompts, errors, and privacy notices are all presented only in Chinese, including consent-related messaging. Because this file is a general-purpose code tool rather than a clearly documented region-specific compliance utility, forcing a single language without user choice fits the locale-policy violation criteria.
Lines L741-L742 set the page language from DATA.lang, defaulting to und, but the file provides no natural-language indication that language or locale is user-selectable or constrained for a justified regional purpose. Because locale behavior is being imposed by input/config without any visible opt-in or explanation in this file, it may violate the requirement to avoid forced language settings without user choice.
No suspicious patterns detected.
