Security audit
Security checks across malware telemetry and agentic risk
This skill appears to deploy the advertised World Cup scores site, but its setup script pulls changing external code, runs it in the background, and can kill any service using port 3001.
Review the external GitHub repository before running this skill, preferably pin it to a known commit and run it in a container or disposable host. Avoid the one-click script on systems where port 3001 may be used by another service, and confirm how to stop the background Node process before installing. VirusTotal and the static scan were clean, so the concern is operational scope and supply-chain control, not confirmed malware.
node server.js # 生产模式（后台守护） nohup node server.js > server.log 2>&1 & ``` 访问 `http://你的服务器IP:3001` 即可使用。
62/62 vendors flagged this skill as clean.
No suspicious patterns detected.
