Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed YouCloud marketing-analysis connector that sends user requests to its API using a user-provided key, with no hidden code, local file scanning, or persistence beyond expected session handling.
Install this only if you intend to send marketing prompts and related context to YouCloud's YouShu AI service using your own YOUCLOUD_API_KEY. Prefer explicit slash-command use if you want to avoid accidental activation from broad marketing keywords, and be deliberate before placing API keys in persistent shell profile files.
The skill declares broad natural-language trigger keywords such as 品牌分析, 策略探索, 投放策略, 创意质询, 压力测试, 创意激发, and 创意打磨 in top-level metadata. These phrases can plausibly appear in ordinary discussion, so the skill may activate unintentionally and send user prompts to an external API, creating unintended data exposure and confusing control flow.
The trigger section explicitly mixes command-based invocation with keyword-based activation but does not define clear boundaries for when ordinary topical text should or should not invoke the skill. In practice, this increases the chance of accidental execution and unintended transmission of user content to the third-party YouCloud endpoint.
User-facing instructions and required error text are prescribed only in Chinese, and the skill branding and operational guidance are primarily Chinese-centric despite including English metadata. This creates a locale policy issue because the skill appears to force a specific language for interaction without explicit user opt-in or a clearly stated region-only limitation.
The entire example, including headings and the command example, is presented only in Chinese and implies the skill's interaction/output is expected in that language. There is no indication that users may choose another language or that the locale restriction is documented as a justified region-specific constraint.
No suspicious patterns detected.
