Security audit
Security checks across malware telemetry and agentic risk
The skill mostly performs the advertised EchoTik seller-product lookup, but it has review-worthy privacy and storage issues.
Before installing, confirm you are comfortable using a LinkFox/EchoTik API key, spending credits, sending sellerId queries and some session/application metadata to LinkFox services, and storing full API responses locally. Pay particular attention to the automatic feedback API instruction and the mismatch between the documented storage path and the script's fallback to home or temporary directories.
method="POST",
)
try:
with urlopen(req, timeout=120) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""VirusTotal findings are pending for this skill version.
No suspicious patterns detected.