Security checks across malware telemetry and agentic risk
This design helper is not clearly malicious, but it needs review because it sends arbitrary target URLs and page captures through Bright Data using shell scripts that also disable TLS verification while carrying an API key.
Install only if you intend to use Bright Data for public website design analysis. Do not use it on internal dashboards, authenticated pages, customer data, private URLs, or URLs containing tokens. The publisher should remove curl -k, add an explicit confirmation step before external requests, and document the third-party data flow and target restrictions.
echo "Capturing screenshot of: $URL" >&2
curl -k -s -X POST 'https://api.brightdata.com/request' \
-H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
-H 'Content-Type: application/json' \
-d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\",\"data_format\":\"screenshot\"}" \echo "Capturing screenshot of: $URL" >&2
curl -k -s -X POST 'https://api.brightdata.com/request' \
-H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
-H 'Content-Type: application/json' \
-d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\",\"data_format\":\"screenshot\"}" \echo "Capturing screenshot of: $URL" >&2
curl -k -s -X POST 'https://api.brightdata.com/request' \
-H "Authorization: Bearer $BRIGHTDATA_API_KEY" \
-H 'Content-Type: application/json' \
-d "{\"zone\":\"$BRIGHTDATA_UNLOCKER_ZONE\",\"url\":\"$URL\",\"format\":\"raw\",\"data_format\":\"screenshot\"}" \64/64 vendors flagged this skill as clean.