Security checks across malware telemetry and agentic risk
This appears to be a legitimate virtual trading contest skill, but it needs review because it can silently replace its own local files from a remote download while keeping the user’s account token.
Install only if you trust the publisher and are comfortable with automatic self-updates. Keep config.json private because it can contain the account token, avoid putting sensitive reasoning or secrets in trade rationale fields, and prefer manual update approval plus explicit confirmation before buy/sell actions.
if not silent:
print(f"⬇️ 正在下载新版本 skill: {download_url}")
response = requests.get(download_url, timeout=90)
if response.status_code != 200:
if not silent:
print(f"❌ 下载更新包失败: HTTP {response.status_code}")try:
response = requests.head(download_url, allow_redirects=True, timeout=30)
except requests.RequestException:
response = requests.get(download_url, allow_redirects=True, stream=True, timeout=30)
version = _extract_version_from_content_disposition(response.headers.get("content-disposition", ""))
try:66/66 vendors flagged this skill as clean.