Security audit
Security checks across malware telemetry and agentic risk
This is a real RPA automation skill, but it stores and reuses sensitive credentials and runs generated Python with broad local authority.
Install only if you are comfortable with a local RPA tool that can run generated Python, control a browser, call APIs, write files, and persist credentials. Do not use it on shared or untrusted machines; avoid recording high-value accounts; treat saved cookie files and generated scripts as secrets; prefer environment variables or a secret manager instead of embedded API keys; review generated rpa/*.py files before running them.
# Compile (syntax check on wrapped code; adjust reported line by -1 for wrapper)
try:
compiled = compile(async_code, "<python_snippet>", "exec")
except SyntaxError as e:
lineno = max(1, (e.lineno or 1) - 1)
return f"python_snippet 语法错误 / syntax error: line {lineno}: {e.msg}"# Execute: define __snippet__ then await it
try:
exec(compiled, ns) # noqa: S102 — defines __snippet__ in ns
await ns["__snippet__"]() # run the async snippet
print("[recorder] python_snippet 验证通过 / validation passed ✓", flush=True)
return Nonereturn 1
print(f"▶️ 正在运行 / Running: 「{task_name}」…")
result = subprocess.run([sys.executable, str(script_path)])
if result.returncode == 0:
print(f"✅ 运行完毕 / Done: 「{task_name}」")
else:1/46 vendors flagged this skill as malicious, and 45/46 flagged it as clean.
Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification, suspicious.obfuscated_code