cultural-tourism-xiaohongshu-feed

SUSPICIOUS. The skill’s behavior matches its stated purpose, and it has no download-execute or wildcard-permission patterns, so it does not look malicious. However, it routes queries and the required API key through a non-official third-party service (doubaoya.com) whose exact endpoint/public developer documentation could not be independently verified, creating moderate trust and data-flow risk.