Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese-language freelance opportunity helper that uses disclosed web requests to scan job platforms and does not show hidden execution, persistence, or destructive behavior.
Before installing, expect the agent to make web requests to freelance and content platforms and to use any skill/profile details you put in the local HUSTLE.md file for recommendations. Review generated proposals before sending them, as the skill itself also advises.
The skill's title, description, commands, configuration guidance, and examples are entirely in Chinese, with no indication that other languages are supported or that Chinese is a necessary regional constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is explicitly justified.
The skill explicitly advertises automatic scanning of multiple third-party platforms but does not warn users that prompts, search terms, IP address, and possibly profile-related context may be transmitted to external services. In a skill that encourages repeated web/API access, omission of a privacy and data-transmission notice can mislead users into sharing data they did not intend to send off-platform.
The example command issues an outbound POST request to an external API endpoint, which creates a real data-transmission boundary and can expose user-derived query context, metadata, and network identifiers to a third party. Because the skill is designed to automate scanning, this behavior could occur repeatedly and without adequate user awareness if integrated directly into agent actions.
curl -s "https://api.juejin.cn/recommend_api/v1/short_msg/recommend" \
-H "Content-Type: application/json" \
-d '{"id_type":2,"sort_type":200,"cursor":"0","limit":20}' \
| jq '.data[].msg_Info.content' | head -10
The example command issues an outbound POST request to an external API endpoint, which creates a real data-transmission boundary and can expose user-derived query context, metadata, and network identifiers to a third party. Because the skill is designed to automate scanning, this behavior could occur repeatedly and without adequate user awareness if integrated directly into agent actions.
curl -s "https://api.juejin.cn/recommend_api/v1/short_msg/recommend" \
-H "Content-Type: application/json" \
-d '{"id_type":2,"sort_type":200,"cursor":"0","limit":20}' \
| jq '.data[].msg_Info.content' | head -10
No suspicious patterns detected.