Security audit
Security checks across malware telemetry and agentic risk
This skill’s core purpose is understandable, but it asks for full X session credentials, runs continuously, fetches arbitrary linked pages, and sends bookmark-derived content into external analysis paths with uneven disclosure and control.
Install only if you are comfortable giving the skill effective full-session access to your X account and letting it continuously process bookmarks and linked pages. Use a low-value or dedicated X account if possible, keep the .env file out of backups and repositories, review PM2 persistence, and disable or avoid automatic link fetching, external LLM analysis, notifications, and payment/licensing flows unless you explicitly need them.
### ⚠️ Important Security Notes - **These cookies are like your password** - they give full access to your X account - **Never share them with anyone** - **Don't post them online or commit them to git** - They're stored locally in `.env` with strict permissions (600 = only you can read)
writeFileSync(envPath, content);
chmodSync(envPath, 0o600); // Read/write for owner only
print(`\n✅ Created .env file (permissions: 600)`, green);
print(` ${envPath}`, cyan);
}# Remove all user-specific files rm -f .env config.json bookmarks.json rm -rf ../../life/resources/bookmarks/* # Verify cleanup npm run verify
52/52 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec