Security audit
Security checks across malware telemetry and agentic risk
The skill is a coherent crawler/database application, but it starts persistent networked services and automated web crawling with several security hardening gaps that warrant Review before installation.
Install only in a contained trusted environment. Review the supplier list and crawl schedule before starting workers, keep Redis/API/dashboard off public interfaces or add authentication, use egress allowlisting where possible, avoid cookie-based crawling unless you have explicit authorization, and pin dependencies for production use.
start_time = datetime.now()
try:
result = subprocess.run(
cmd, capture_output=True, text=True,
timeout=config.max_time + 300, cwd=str(self.base_dir),
)f"--depth={depth}", "--stay-on-same-domain", "--connection-per-second=1", "-q",
]
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
return {"return_code": result.returncode, "url_count": len(urls),
"timed_out": False}
except subprocess.TimeoutExpired:# Load local values for the installer without logging them.
set -a
# shellcheck disable=SC1091
. ./.env
set +a
if [ -z "${DB_PASSWORD:-}" ] || [ "$DB_PASSWORD" = "change-this-to-a-long-random-password" ]; then# HTTrack-powered live crawling architecture (see SKILL.md / docs/) # ---- API / web ---- fastapi>=0.115 uvicorn[standard]>=0.30 pydantic>=2.8 pydantic-settings>=2.4
# ---- API / web ---- fastapi>=0.115 uvicorn[standard]>=0.30 pydantic>=2.8 pydantic-settings>=2.4 python-multipart>=0.0.9
fastapi>=0.115 uvicorn[standard]>=0.30 pydantic>=2.8 pydantic-settings>=2.4 python-multipart>=0.0.9 # ---- Database ----
uvicorn[standard]>=0.30 pydantic>=2.8 pydantic-settings>=2.4 python-multipart>=0.0.9 # ---- Database ---- sqlalchemy>=2.0
python-multipart>=0.0.9 # ---- Database ---- sqlalchemy>=2.0 psycopg2-binary>=2.9 alembic>=1.13 redis>=5.0
# ---- Database ---- sqlalchemy>=2.0 psycopg2-binary>=2.9 alembic>=1.13 redis>=5.0
# ---- Database ---- sqlalchemy>=2.0 psycopg2-binary>=2.9 alembic>=1.13 redis>=5.0 # ---- Task queue ----
sqlalchemy>=2.0 psycopg2-binary>=2.9 alembic>=1.13 redis>=5.0 # ---- Task queue ---- celery>=5.4
redis>=5.0 # ---- Task queue ---- celery>=5.4 # ---- Crawling / mirroring ---- # httrack is a SYSTEM package: sudo apt install httrack libhttrack-dev
# httrack is a SYSTEM package: sudo apt install httrack libhttrack-dev # ---- HTML parsing (local mirror files only) ---- beautifulsoup4>=4.12 lxml>=5.2 parsel>=1.9
# ---- HTML parsing (local mirror files only) ---- beautifulsoup4>=4.12 lxml>=5.2 parsel>=1.9 # ---- PDF / Excel parsing ----
# ---- HTML parsing (local mirror files only) ---- beautifulsoup4>=4.12 lxml>=5.2 parsel>=1.9 # ---- PDF / Excel parsing ---- pdfplumber>=0.11
VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal