Security checks across malware telemetry and agentic risk
This Roku control skill is mostly purpose-aligned, but it includes under-disclosed Telegram and local pipe control paths that can issue Roku commands without clear access controls.
Review before installing or running. Use a strong unique bridge token, keep the bridge bound to localhost or a trusted network, and avoid running the Telegram or pipe listener scripts unless you intentionally want remote bot-based control and have restricted who can use the bot.
if line.startswith("roku_"):
btn = line.replace("roku_", "")
if hasattr(r, btn):
getattr(r, btn)()
print(f"→ {btn}", flush=True)
# Handle "btn NAME" format
elif line.startswith("btn "):elif line.startswith("btn "):
btn = line.split(" ", 1)[1]
if hasattr(r, btn):
getattr(r, btn)()
print(f"→ {btn}", flush=True)
except:
time.sleep(0.01)61/61 vendors flagged this skill as clean.