Security audit
Security checks across malware telemetry and agentic risk
The skill appears to support 1688 product and image search, but it under-discloses public uploads, local response storage, and environment-routed authenticated requests.
Review before installing. This skill may send API keys and session metadata to a configurable gateway, upload selected images to public URLs, and save full search responses on disk. Use it only in an environment where those variables and files are controlled, avoid sensitive images, and check saved response files before sharing or committing the workspace.
}
req = Request(get_api_base() + path, data=data, headers=headers, method="POST")
try:
with urlopen(req, timeout=TIMEOUT_SECONDS) as response:
body = response.read().decode("utf-8")
return json.loads(body) if body else {}
except HTTPError as exc:method="POST",
)
try:
with urlopen(req, timeout=120) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""method="POST",
)
try:
with urlopen(req, timeout=120) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""method="POST",
)
try:
with urlopen(req, timeout=120) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else "")
try:
with urlopen(req, timeout=120) as response:
if response.status not in (200, 201):
print(f"Upload failed with status: {response.status}", file=sys.stderr)
sys.exit(1)VirusTotal findings are pending for this skill version.
No suspicious patterns detected.