Security audit
Security checks across malware telemetry and agentic risk
This research skill is not clearly malicious, but it uses high-impact local session credentials and persists research data in ways users should review before installing.
Install only if you are comfortable with a research tool using local X browser cookies or AUTH_TOKEN/CT0, reading Codex login credentials as an OpenAI fallback, sending search topics/URLs to third-party services, and retaining reports/findings locally. Prefer explicit API keys where possible, keep the secrets file private, avoid sensitive topics unless you are comfortable with persistence and provider disclosure, and review/delete the local data directory periodically.
"""Save model selection cache."""
ensure_cache_dir()
try:
with open(MODEL_CACHE_FILE, 'w') as f:
json.dump(data, f)
except OSError:
pass# Raw responses
if raw_openai:
with open(OUTPUT_DIR / "raw_openai.json", 'w') as f:
json.dump(raw_openai, f, indent=2)
if raw_xai:json.dump(raw_openai, f, indent=2)
if raw_xai:
with open(OUTPUT_DIR / "raw_xai.json", 'w') as f:
json.dump(raw_xai, f, indent=2)
if raw_reddit_enriched:json.dump(raw_xai, f, indent=2)
if raw_reddit_enriched:
with open(OUTPUT_DIR / "raw_reddit_threads_enriched.json", 'w') as f:
json.dump(raw_reddit_enriched, f, indent=2)63/63 vendors flagged this skill as clean.
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal