Security audit
Security checks across malware telemetry and agentic risk
The skill is a real research assistant, but it needs Review because it can run install-time code, use local AI credentials, send research notes to external LLM endpoints, and operate over SSH with weak controls.
Install only after reviewing the installer and scripts. Use Manual mode for sensitive projects, verify which LLM endpoint and API key will be used, avoid using broad SSH keys or production servers, re-enable host key verification if possible, and periodically inspect or delete the skill's memory directory.
ssh += ["-i", os.path.expanduser(key)]
ssh += [f"{user}@{host}", cmd]
try:
r = subprocess.run(ssh, capture_output=True, text=True, timeout=timeout+5)
return r.stdout.strip()
except Exception:
return Nonecmd += [f"{user}@{host}", remote_cmd]
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout+5)
return result.stdout.strip(), result.stderr.strip()
except subprocess.TimeoutExpired:
return None, "SSH timeout"57/57 vendors flagged this skill as clean.