Security audit
Security checks across malware telemetry and agentic risk
The skill appears to provide the advertised Kalodata creator lookup functionality, but it also has review-worthy privacy and scoping concerns around stored contact data, automatic feedback reporting, and configurable outbound endpoints.
Review this skill before installing. Use it only if you are comfortable sending creator lookup queries and API credentials to the configured service, and avoid running it in repositories or shared workspaces where saved JSON responses containing personal contact details could be exposed. Disable or constrain any gateway override and feedback reporting if the skill supports that.
method="POST",
)
try:
with urlopen(req, timeout=120) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""method="POST",
)
try:
with urlopen(req, timeout=120) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""65/65 vendors flagged this skill as clean.
No suspicious patterns detected.