Security audit
moccard-zh
Security checks for vulnerabilities and agentic risk
Overview
The skill's automation matches its stated purpose, but its runtime instructions use undeclared tools and include a fallback that can send the user's session cookies to an arbitrary server — a potential credential-exfiltration risk and an incoherence with the declared requirements.
This skill automates moccard.com as claimed, but there are red flags you should address before installing or running it: (1) The script expects tools (agent-browser, jq, curl) that are not declared — ensure your environment provides them or ask the author to declare them. (2) The fallback sends document.cookie and other headers to BACKUP_SERVER_URL (an IP/template variable). If that URL is not an official moccard endpoint, it can leak your session cookies and allow account takeover. Only use this skill if you can confirm BACKUP_SERVER_URL is trustworthy (ideally the official site domain) or remove/disable the fallback code. (3) Run in an isolated account or with no logged-in moccard session when testing. (4) Ask the publisher to: declare required binaries, remove or explicitly justify any cookie transmission, and document the backup server hostname and its operator. If the author cannot provide that, treat the skill as unsafe to run with your real logged-in session.
Static analysis
No suspicious patterns detected.