Security audit
Security checks for vulnerabilities and agentic risk
This skill openly provides anti-detection browser scraping tools and makes a persistent shell profile change, but it does not clearly define authorized-use limits or ask before changing the user's environment.
Review this skill before installing. Only use the browser automation and scraping commands on sites and data you are authorized to access, and check the target site's policies and privacy obligations. If installing, inspect install.sh first because it modifies your shell startup file to put this skill's bin directory on PATH for future sessions.
The skill explicitly promotes anti-detection browser automation to bypass site defenses and scrape data, but provides no warning about legal, policy, privacy, or data-handling constraints. In this context, the omission is dangerous because it normalizes evasion of platform protections and makes misuse for unauthorized scraping more likely, especially against named targets like Bilibili.
The installer unconditionally appends an export line to the user's shell startup file, permanently modifying their environment without an explicit confirmation step. While this is common in convenience installers, it creates an unexpected persistent change and could be abused in less trustworthy packages to alter execution behavior via PATH precedence.
The natural-language instructions and command descriptions are presented almost entirely in Chinese, which imposes a specific language on users without opt-in or justification. The policy requires either offering a language choice or clearly documenting a justified locale constraint.
The script's comments and user-visible installation messages are in Chinese, and there is no indication that language selection is optional or that the tool is intended only for a Chinese-speaking context. This can violate language/locale policy when a skill imposes a specific language without user choice or justification.
No suspicious patterns detected.
