Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because its installation guide reportedly runs a downloaded shell script without verifying it; the privacy warning finding adds concern, and scan coverage was partial.
Review the installation steps before proceeding. Consider whether you trust the source of the downloaded script and can verify it before running it. Avoid sending credentials, secrets, or unnecessary sensitive details in diagnostic requests. The scan was partial: five of six components were fully inspected, and one static analysis was degraded, so the evidence is incomplete.
Step 1 instructs the agent to submit the user's goal to SysAgent, which transmits user-provided text to Alibaba Cloud. Although the document identifies the cloud service, it does not warn that submitted diagnostic requests may contain sensitive information or advise excluding secrets and unnecessary private data.
The command immediately executes a remotely downloaded script without inspecting it or verifying an independently trusted signature or digest. HTTPS and the official vendor endpoint reduce exposure but do not prevent a compromised distribution endpoint from supplying arbitrary code, which would run with the invoking user's privileges on a potentially sensitive operations host.
