Security audit
Security checks across malware telemetry and agentic risk
The skill is a disclosed recommendation/search helper, but it asks users to store live social-media cookies and includes unsafe shell execution paths that could run unintended local commands.
Review carefully before installing. Only use this in an isolated environment if you understand the risk of copying browser cookies, and do not provide active account cookies unless you are comfortable with any local code that can read the skill files using those sessions. The shell-based search scripts should be fixed before normal use.
def search_xhs(keyword, num=10):
"""使用 xhs-cli 搜索"""
cmd = f'source ~/.agent-reach-venv/bin/activate && xhs search "{keyword}" --sort popular --json'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
try:
data = json.loads(result.stdout)def search_youtube(keyword, num=5):
"""搜索 YouTube 视频"""
cmd = f'yt-dlp --dump-json "ytsearch{num}:{keyword}"'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
results = []
for line in result.stdout.strip().split('\n'):65/65 vendors flagged this skill as clean.
No suspicious patterns detected.