Security checks across malware telemetry and agentic risk
This skill does what it claims, but it gives broad terminal and screen-control power with weak safeguards around command injection, trust approvals, screenshots, and saved session logs.
Install only if you are comfortable granting a Node package macOS Accessibility-level control over Terminal and allowing it to capture screenshots and session logs. Use it only in trusted project directories, avoid terminals that show secrets or customer data, do not pass untrusted project paths or long command text, and review or disable saved recordings when handling private repositories.
session.outputBuffer.includes('Trust')) {
clearInterval(checkReady);
// Auto-approve: send "1" for "Yes, I trust this folder"
console.log(`[CC-${sessionId}] ✅ Security prompt detected, auto-approving...`);
session.proc.stdin.write('1\n');}
/**
* Save session to file
*/
async function saveSession(sessionId, filepath) {
const session = sessions.get(sessionId);64/64 vendors flagged this skill as clean.