Brazilian CEP using the ViaCEP API
Security checks across malware telemetry and agentic risk
Overview
This skill's code, instructions, and requirements are consistent with its stated purpose (looking up Brazilian CEPs via the public ViaCEP API); nothing in the bundle asks for unrelated credentials or installs arbitrary remote code.
This skill appears to do exactly what it says: it needs node/npm and the axios npm dependency to make outgoing HTTPS requests to the public ViaCEP API. Before installing, note: (1) installation will run npm install which downloads packages from the public registry; review package.json if you want to vet dependencies. (2) When invoked the skill will send the CEP (postal code) to viacep.com.br — if CEPs you send are considered private in your context, avoid sharing them. (3) The SKILL.md metadata has a small mismatch (it lists axios as a binary), but that is harmless. If you want extra assurance, run the included tests in mock mode (node test.js --mock) to verify local behavior without network calls.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
VirusTotal findings are pending for this skill version.