Security audit
Security checks across malware telemetry and agentic risk
This movie-search skill is purpose-aligned on the surface, but it ships hardcoded NAS credentials and can create or delete Synology download tasks without clear safeguards.
Review carefully before installing. Replace and rotate the embedded NAS credentials, move configuration to secure user-supplied secrets, use HTTPS where available, require explicit confirmation before every download or deletion, restrict allowed URI schemes and destination folders, add authentication to the FastAPI service, and pin dependencies.
data["destination"] = destination
try:
resp = requests.post(url, data=data, timeout=15)
result = resp.json()
if result.get("success"):fastapi>=0.115.0 uvicorn>=0.32.0 httpx>=0.27.0 requests>=2.32.0
fastapi>=0.115.0 uvicorn>=0.32.0 httpx>=0.27.0 requests>=2.32.0 beautifulsoup4>=4.12.0
fastapi>=0.115.0 uvicorn>=0.32.0 httpx>=0.27.0 requests>=2.32.0 beautifulsoup4>=4.12.0
fastapi>=0.115.0 uvicorn>=0.32.0 httpx>=0.27.0 requests>=2.32.0 beautifulsoup4>=4.12.0
uvicorn>=0.32.0 httpx>=0.27.0 requests>=2.32.0 beautifulsoup4>=4.12.0
62/62 vendors flagged this skill as clean.
No suspicious patterns detected.