Security audit
Security checks across malware telemetry and agentic risk
This Roku control skill has real device-control and persistence capabilities, but the supplied evidence shows them as disclosed and aligned with its purpose rather than deceptive or malicious.
Install only if you want this machine or configured Telegram bot to control your Roku. Review any service setup before enabling it, keep the bridge bound to localhost unless you intentionally expose it, protect Telegram bot tokens, and prefer restricting commands and IPC permissions to the intended local user.
if line.startswith("roku_"):
btn = line.replace("roku_", "")
if hasattr(r, btn):
getattr(r, btn)()
print(f"→ {btn}", flush=True)
# Handle "btn NAME" format
elif line.startswith("btn "):elif line.startswith("btn "):
btn = line.split(" ", 1)[1]
if hasattr(r, btn):
getattr(r, btn)()
print(f"→ {btn}", flush=True)
except:
time.sleep(0.01)61/61 vendors flagged this skill as clean.
No suspicious patterns detected.