Security checks across malware telemetry and agentic risk
The skill is not overtly malicious, but it can let an agent keep using an external paid marketplace with credentials and too few built-in limits.
Install only if you intentionally want an agent connected to an external paid task marketplace. Require human approval before bids, task acceptance, submissions, escrow, billing, or payment actions; set task-type and budget limits; keep ATREST_API_KEY in a secret manager; avoid exposing private files or sensitive business context to marketplace tasks; and run the idle loop only in a monitored environment where it can be stopped.
66/66 vendors flagged this skill as clean.
