Security audit
Security checks across malware telemetry and agentic risk
This writing and search skill is not clearly malicious, but it needs Review because it can collect phone/SMS verification data, create or retrieve an external service credential, and persist that key in ~/.zshrc with under-disclosed user-facing wording.
Review before installing if you are uncomfortable giving an agent your phone number and SMS code for a third-party service, or with a search API key being stored persistently in ~/.zshrc. For sensitive government, enterprise, or internal documents, confirm what text will be sent to dknowc services and prefer explicit consent or non-persistent credential storage.
def call_outline_api(query: str, api_key: str, timeout: int) -> tuple[int, dict | str, float]:
start = time.time()
response = requests.post(
OUTLINE_API_URL,
headers={
"api-key": api_key,VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution