Trend Scope Report
Security checks across malware telemetry and agentic risk
Overview
The skill mostly matches its report-generation purpose, but it uses API credentials and report queries with a fixed non-HTTPS IP endpoint and an undeclared fallback API key.
Install only if you trust the Feedax endpoint and are comfortable sending report queries to it. Use a dedicated API key, avoid personal or sensitive identifiers in queries, and consider confirming whether the HTTP IP address should be replaced with an HTTPS Feedax domain.
VirusTotal
67/67 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may use a Feedax credential that the user did not specifically configure for this report skill.
The skill declares FEEDAX_REPORT_API_KEY as the required credential, but the code also silently accepts FEEDAX_SEARCH_API_KEY as a fallback credential.
DEFAULT_API_KEY = (
os.getenv("FEEDAX_REPORT_API_KEY", "").strip()
or os.getenv("FEEDAX_SEARCH_API_KEY", "").strip()
)Use a dedicated, least-privilege API key for this skill and remove or document the fallback credential behavior.
API-key-backed requests and report search terms may be exposed on the network or sent to an endpoint users cannot easily verify.
The report API destination is a hard-coded plain-HTTP IP address rather than a clearly identified HTTPS provider endpoint.
API_BASE_URL = "http://221.6.15.90:18011" REPORT_ENDPOINT = "/search-service/report"
Verify that this IP is the intended Feedax endpoint, prefer HTTPS, and avoid sending sensitive subjects or personal data in report queries.
This is expected for a CLI-based report generator, but it will run local code, contact the API, and create local report files.
The skill instructs the agent to execute a local Python CLI using user-derived query parameters.
python3 scripts/report_cli.py --query "关键词" --days 7 --full-analysis
Review the generated query and output directory before running reports for sensitive topics.
Opening the HTML report may execute externally hosted JavaScript and reveal that the report was opened to the CDN.
The generated HTML report template loads charting JavaScript from a third-party CDN.
<script src="https://cdn.jsdelivr.net/npm/echarts@5.4.3/dist/echarts.min.js"></script>
Use a local bundled copy of ECharts or add integrity controls if reports are opened in sensitive environments.