weizhao-vip-search

This skill does what it says (search VIP.com) but asks you to copy and paste a full logged-in browser Cookie — which is effectively a secret that can grant access to your account. Before installing or using it: - Do NOT paste your full session cookie into chat. Prefer running the included script locally on your own machine and passing the cookie only on your machine (and preferably by a safer method than a command-line argument, e.g., read from stdin or a temp file with restricted permissions). - Inspect the included script (scripts/search_vip.py) yourself — it currently only contacts VIP.com, but any code can be changed to exfiltrate cookies elsewhere. Only run the exact source you reviewed. - Use a throwaway/ephemeral login session if possible, or create a temporary account/session that you can revoke afterwards. After use, log out and/or invalidate the session from your account settings. - Note the example command uses a hardcoded local path — ensure you run the script from the repository path (or adjust the path) rather than copying the example verbatim. - Prefer safer alternatives: use public search pages that don't require login, or an official API/OAuth flow if VIP.com provides one. If you are not comfortable handling session cookies or cannot ensure you’ll run the reviewed script locally, do not provide your cookie to this skill.