Security audit
Security checks across malware telemetry and agentic risk
This research skill should be reviewed before installation because it can read local browser login cookies and use local GitHub credentials beyond what its main security text clearly explains.
Install only if you are comfortable with a research tool reading local browser session cookies and using local developer credentials. Prefer setting FROM_BROWSER=off and supplying explicit limited API keys. Avoid the GitHub/ScrapeCreators setup path unless you understand that a local gh token may be sent to that service, and expect raw reports plus config state to be stored locally.
return env_token
# Fallback: try gh CLI
try:
result = subprocess.run(
["gh", "auth", "token"],
capture_output=True, text=True, timeout=5,
)67/67 vendors flagged this skill as clean.
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal