Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent analytics purpose, but it asks users to provide creator-platform cookies without explaining credential handling or privacy safeguards.
Review this skill carefully before installing. Only provide platform cookies if you understand they may act like account sessions, prefer scoped tokens or official APIs when available, and avoid sharing cookies for accounts where unintended access would be costly. Confirm where analytics data and cookies are stored and whether data is sent to GLM-5 or another external model.
The invocation example "给我内容优化建议" is generic and could match many unrelated content-creation or writing requests, making activation scope unclear. The file does not provide constraints, negative examples, or a narrower trigger context to distinguish this skill from other general advice skills.
The skill requests cookie-based access for creator platforms and references Playwright web scraping, but provides no user-facing warning about credential sensitivity, consent, retention, or where scraped data is sent for AI analysis. This creates a real risk of account/session-token misuse, over-collection of personal or platform data, and inadvertent disclosure to third-party model providers or logs.
The skill documentation and example outputs are entirely specified in Chinese, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill implicitly forces one language without opt-in.
No suspicious patterns detected.
