Walter Competitor

This skill bundles working code that expects you to install and configure a third‑party CLI (mcporter) with a SellerSprite secret, but the package metadata doesn't declare those requirements — that's a red flag. The code runs mcporter via subprocess.run(..., shell=True) and builds shell commands from input values without robust escaping: untrusted or specially crafted keywords could lead to command injection. Before installing or running it: - Confirm you trust the skill author and SellerSprite service. The owner is unknown and there is no homepage. - Do not supply production credentials or secrets until you understand where they'll be stored. The skill expects a secret-key in mcporter config (or URL) but does not declare an environment variable or secure storage mechanism. - Consider running the code in an isolated environment (VM/container) and review/modify the sellersprite_mcp.run_mcporter call to avoid shell=True or to properly escape/encode arguments. - Ask the author to: (1) declare required binaries and credentials in metadata, (2) remove shell usage or add safe escaping, and (3) document what data is sent to external endpoints and retention policies. Given these mismatches and the subprocess usage, treat this skill as suspicious until the above issues are resolved or you can audit and sandbox its execution.