自动登录助手
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's purpose (auto-fill logins) is plausible, but the SKILL.md contains hard-coded, platform-wide credentials and instructs agents to read a relative SECRET.md path — behavior that is disproportionate and risks secret exposure.
This skill contains plaintext credentials for multiple services and tells agents to read a relative SECRET.md path — both are red flags. Do not install or run it unless you fully trust the source. Before using: (1) remove the hard-coded credentials from SKILL.md; (2) ensure the skill explicitly declares which secret it needs and uses secure secret storage (environment variables or a protected secrets manager) rather than files in repo; (3) rotate or revoke any exposed passwords/keys (the credentials shown should be considered compromised); (4) run the skill in a restricted/sandboxed environment and require explicit user approval before any auto-login; (5) prefer an implementation that prompts the user for credentials at runtime or reads from a vetted secret store rather than reading arbitrary relative paths. If you cannot verify the source or cannot remove the embedded secrets, do not use this skill.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.