Security audit
Security checks across malware telemetry and agentic risk
The skill mostly matches its news-briefing purpose, but it also exposes broader YNote account operations and runs an unpinned npm fallback package at runtime.
Install only if you are comfortable with the skill reading recent favorite-note excerpts, deriving search topics from them, and optionally running every day. Use a dedicated Perplexity key, review the YNote API permissions, avoid enabling the cron job unless you want recurring access, and treat the `open-websearch@latest` fallback as a supply-chain risk until it is pinned or removed.
const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
try {
const resp = await fetch('https://api.perplexity.ai/search', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
try {
const resp = await fetch('https://api.perplexity.ai/search', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,66/66 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal