Security checks across malware telemetry and agentic risk
This competitor-monitoring skill mostly matches its purpose, but it needs review because it ships with active preset targets, stores license identity data, persists monitoring history, and sends digests through third-party channels.
Review before installing. Clear or deactivate the bundled competitors, confirm exactly which cron jobs and delivery channels will run, use dedicated low-scope bot tokens or webhooks, avoid tracking internal/private URLs, and only activate a paid license if you are comfortable with the license key and purchaser email being stored locally in plaintext.
def curl_fetch(url: str, timeout: int = 10) -> str | None:
try:
result = subprocess.run(
[
"curl", "-sL", "--max-time", str(timeout),
"--user-agent", "Mozilla/5.0",+ ["--channels"] + channels
)
try:
subprocess.run(cmd, timeout=30)
except Exception as e:
print(f"[alert] Delivery error: {e}", file=sys.stderr)
finally:"-d", json.dumps(payload),
]
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
if result.returncode != 0:
print(f"[deliver/discord] curl failed: {result.stderr[:100]}", file=sys.stderr)
return False66/66 vendors flagged this skill as clean.