Sentiment Compass
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code, instructions, and external calls are generally consistent with a subscription-based social-media scraping + sentiment tool, but it performs networked license verification and stores credentials locally—review those behaviours before use.
This skill behaves like a coherent social-media scraper + analyzer, but review a few items before installing or using it with real secrets: - Expect local files: it will create ~/.sentiment-compass/ (data.db, config.json, logs) and ~/.sentiment_cache/; config.json stores keys and SMTP credentials in plaintext. If you need secrecy, store only throwaway/test credentials or modify the code to encrypt secrets. - External verification: if you configure a subscription token (prefixes like SENTIMENT-...), the skill will POST that token to https://geo-api.yk-global.com/validate for tier verification. If you prefer not to disclose such tokens, do not set them or review/disable verify_token() in the code. - GLM-4 key and SMTP credentials: the skill will use them to call external services (open.bigmodel.cn and your SMTP server). Prefer scoped/test keys and review outbound network traffic if you need assurance. - Playwright: running the scraper requires Playwright and a headless browser; that will make automated web requests. Make sure you understand the legal and ToS implications of scraping the target sites in your jurisdiction and environment. - If unsure: run the package in an isolated environment (VM/container) and audit network calls (e.g., with a proxy) while testing, and inspect/modify the code paths that perform remote verification or storage of secrets.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.