Security audit
Security checks across malware telemetry and agentic risk
The skill largely matches its JumpServer query purpose, but it handles infrastructure credentials while disabling TLS certificate verification, so it needs review before use.
Install only in a trusted local environment, protect .env.local as a secret file, avoid shared workspaces, and prefer network paths where certificate verification can be restored or independently controlled. Review the use of JMS_SDK_MODULE/JMS_SDK_GET_CLIENT and --confirm-install before allowing an agent to run the skill.
def import_string(path: str) -> Any:
module_name, attr_name = path.rsplit(".", 1)
module = importlib.import_module(module_name)
return getattr(module, attr_name)
def load_get_client() -> Callable[..., Any]:67/67 vendors flagged this skill as clean.
No suspicious patterns detected.