Security checks across malware telemetry and agentic risk
This is a coherent Buck Mason shopping skill, but it deserves Review because it can handle purchases, account tokens, personal photos, public lookbooks, and vote data.
Install only if you are comfortable with a shopping agent that can use personal profile data, generate and publish try-on lookbooks, and potentially complete purchases. Keep profile.md minimal, avoid saving JWTs when order-code lookup is enough, do not enable @stripe/link-cli or auto-publishing unless you want those workflows, and use --no-voting or local-only output for private lookbooks.
if dst.exists() and dst.stat().st_size > 0:
return
tmp = dst.with_suffix(".tmp")
subprocess.run(["curl", "-sSL", "-o", str(tmp), src_url], check=True)
img = Image.open(tmp).convert("RGB")
h = round(w * 4 / 3)
ratio = max(w / img.width, h / img.height)dst = OUT / f"{look_id}.jpg"
if not dst.exists():
tmp = dst.with_suffix(".tmp")
subprocess.run(["curl", "-sSL", "-o", str(tmp), src_url], check=True)
web_jpeg(tmp, dst, max_w=1200)
tmp.unlink()
look_hero[look_id] = dst.namebase = args.url if args.url.endswith("/") else args.url + "/"
def head(url):
r = subprocess.run(["curl", "-sIL", "--max-time", "15", url], capture_output=True, text=True)
return r.stdout
def get(url):return r.stdout
def get(url):
r = subprocess.run(["curl", "-sSL", "--max-time", "15", url], capture_output=True, text=True)
return r.stdout
# D1VirusTotal findings are pending for this skill version.