Security checks across malware telemetry and agentic risk
This skill is not clearly malicious, but it gives an agent broad desktop-control and screen-reading power and has an unsafe Windows app-launch path that warrants review before installation.
Install only if you intentionally want an agent to control your desktop, type/click in apps, take screenshots, read on-screen text, list windows, and launch or focus applications. Avoid using it on sessions with sensitive data visible, do not pass untrusted app names or arguments to app open, and prefer a sandboxed desktop or test account until the shell/AppleScript injection issues are fixed.
if current_platform == "windows":
if args_list:
subprocess.Popen(
f'start "" "{name}" {" ".join(args_list)}',
shell=True,
)shell=True,
)
else:
subprocess.Popen(f'start "" "{name}"', shell=True)
elif current_platform == "macos":
cmd = ["open", "-a", name]activate
end tell
'''
result = subprocess.run(
["osascript", "-e", script],
capture_output=True,
text=True,"""Install project dependencies using uv."""
print("\n📦 Installing dependencies...")
try:
result = subprocess.run(
["uv", "sync"],
check=True,
capture_output=True,"""Verify the installation by running help command."""
print("\n🔍 Verifying installation...")
try:
result = subprocess.run(
["python", "main.py", "--help"],
capture_output=True,
text=True,"""Provide instructions to install uv."""
print("\n📦 To install uv, run:")
print(" Windows (PowerShell): irm https://astral.sh/uv/install.ps1 | iex")
print(" macOS/Linux: curl -LsSf https://astral.sh/uv/install.sh | sh")
return False66/66 vendors flagged this skill as clean.