Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- caixu-data-mcp/src/search-embedder.ts:90
Security audit
Asset Library Skill
Security checks across malware telemetry and agentic risk
Overview
The skill’s asset-library purpose is coherent, but it handles private local documents through persistent storage and external OCR/provider code while a scanner reports hardcoded API credentials.
Review this carefully before installing. If you proceed, start with a small explicit folder, avoid highly sensitive documents unless necessary, require removal of any hardcoded API key, configure your own provider credentials, and confirm where the SQLite database, embedding cache, and OCR uploads go.
VirusTotal
58/58 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- caixu-ocr-mcp/src/tools/zhipu-http.ts:149
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- caixu-ocr-mcp/src/tools/extract-parser-text.ts:81
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- caixu-ocr-mcp/src/tools/parse-materials.ts:538