Security checks across malware telemetry and agentic risk
The skill is mostly a public disclosure scraper, but it includes undeclared hard-coded API keys and third-party OCR/LLM upload paths that users should review before installing.
Install only in an isolated workspace. Remove and rotate the embedded MiniMax/GLM keys, supply your own credentials only when you intentionally enable OCR/LLM features, and assume downloaded documents, images, extracted phone numbers, and ontology entries will persist locally. Keep target URLs limited to the intended public disclosure sites and avoid running the weakened-browser diagnostic scripts against untrusted pages.
f.write(content)
if dest.stat().st_size > max_kb * 1024:
return f"[PDF too large: {dest.stat().st_size//1024}KB, skipped]", str(dest)
result = subprocess.run(['pdftotext', str(dest), '-'],
capture_output=True, text=True, timeout=60)
return result.stdout, str(dest)
except Exception as e:},
method="POST",
)
with urllib.request.urlopen(req, timeout=60) as resp:
result = json.loads(resp.read())
status = result.get("base_resp", {}).get("status_code", -1)62/62 vendors flagged this skill as clean.