Security audit
Security checks for vulnerabilities and agentic risk
This is a simple web-scraping guidance skill with broad scraping examples, but no hidden code, persistence, credential use, or deceptive behavior was found.
Install only if you are comfortable with a general-purpose scraper. Use it on public or authorized sites, respect robots.txt and site terms, avoid private or authenticated content unless you have permission, and confirm scope before crawling or exporting media or bulk data.
The skill advertises crawling, exporting, table capture, and media collection but does not warn users about privacy, copyright, data-handling, or retention risks. That omission makes the skill more dangerous in context because users may trigger collection or export of personal or sensitive content without understanding the implications, especially when combined with broad scraping commands.
The command triggers are very broad (for example, scrape, crawl, extract, and export with arbitrary URLs and targets) and do not define scope limits, consent requirements, authentication boundaries, or prohibited targets. In an agent setting, this increases the chance of misuse for mass collection, unintended access attempts, or privacy-invasive scraping because the skill can be invoked on virtually any site with little policy friction.
No suspicious patterns detected.
