Security checks across malware telemetry and agentic risk
The skill appears intended to generate personalized daily reports, but it bundles broad network collection, local credential use, behavioral tracking, an unauthenticated background server, and embedded proxy credentials that need user review.
Install only if you are comfortable with a report skill that can contact many external platforms, reuse browser/login state through opencli, read Feishu app credentials, send Feishu messages, run a local server reachable on the network by default, collect reading behavior, and store feedback for personalization. Before use, remove the embedded proxy credential, bind the server to localhost or add authentication, disable or minimize feedback telemetry, require confirmation before profile and notification changes, and review any Graphify or third-party AI export settings.
cmd = f'opencli web read --url "{url}" --format md --output "{work_dir}"'
try:
result = subprocess.run(
cmd, shell=True, capture_output=True, text=True,
timeout=timeout, env=env
)env["https_proxy"] = proxy_url
try:
result = subprocess.run(
full_cmd, shell=True, capture_output=True, text=True,
timeout=timeout, env=env
)67/67 vendors flagged this skill as clean.