Security audit
Security checks across malware telemetry and agentic risk
The skill is a plausible publisher, but it can delete local files, change global developer settings, patch installed tooling, and publish broadly without enough user control.
Install only if you are prepared to review every action first. Run a dry run, use a disposable staging copy of the skill folder, restrict markets explicitly, avoid passing tokens visibly on the command line, and do not allow it to change global git config or patch installed CLI files.
RM_LIST=".git .DS_Store .idea .vscode node_modules .env .env.* *.key *.pem credentials.* secrets.* *.log *.tmp *.bak"
echo "=== 将删除 ==="
for item in $RM_LIST; do find {skill_dir} -name "$item" 2>/dev/null; done
[ "$DRY_RUN" = "true" ] && echo "[DRY RUN]" && exit 0[ "$DRY_RUN" = "true" ] && echo "[DRY RUN]" && exit 0
for item in $RM_LIST; do
find {skill_dir} -name "$item" -type d -exec rm -rf {} + 2>/dev/null
find {skill_dir} -name "$item" -type f -delete 2>/dev/null
done
echo "✅ 清理完成"VirusTotal findings are pending for this skill version.
No suspicious patterns detected.