Security audit
Security checks for vulnerabilities and agentic risk
The skill provides clearly disclosed Geekflare web research and diagnostic tools, with routine privacy, credential, and installation considerations.
Queries, URLs, and extraction prompts go to Geekflare, so exclude confidential details and sensitive URL parameters. Protect the API key and key-bearing MCP URL, expect credit usage, and consider who can access hosted captures. If choosing local installation, pin a reviewed package version; install only the integration needed for your client.
The chunk's sole action is extension installation, rather than execution of the advertised Geekflare operations. Although the repository is related to Geekflare, installing an extension changes the local tool environment and is materially different from merely using the described web capabilities. The behavior of the downloaded extension cannot be established from this chunk.
The local MCP setup uses npx -y @geekflare/mcp without a version pin, allowing a newly published package version to execute without an approval prompt. If the package or publisher account is compromised, malicious code could run with the agent process's permissions and access its API key and other accessible local data; the legitimate setup context does not eliminate this supply-chain risk.
These workflow steps instruct the agent to submit queries and URLs to a third-party service, but the skill does not warn users that those inputs leave their environment. The public-content restriction does not address sensitive information contained in a user's research query or URL parameters.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
When MCP tools are not available, the same features are served at https://api.geekflare.com. Every endpoint is a POST with a JSON body. The key goes in the x-api-key header, never in the URL or query string:
curl -sS -X POST https://api.geekflare.com/dnsrecord \
-H "x-api-key: $GEEKFLARE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com","types":["A","MX"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
When MCP tools are not available, the same features are served at https://api.geekflare.com. Every endpoint is a POST with a JSON body. The key goes in the x-api-key header, never in the URL or query string:
curl -sS -X POST https://api.geekflare.com/dnsrecord \
-H "x-api-key: $GEEKFLARE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com","types":["A","MX"]}'
Detected: suspicious.exposed_secret_literal