Security checks across malware telemetry and agentic risk
The skill is framed as anonymous workplace stress heatmaps, but the artifacts show identity-linked cloud use, local token/profile persistence, broad video ingestion, and mismatched health-analysis behavior.
Do not install this without a privacy and security review. Confirm exactly what video is uploaded, what backend model runs, whether individual health/face outputs are disabled, how open-id and tokens are stored, who can retrieve historical reports, and replace the unresolved yaml dependency with PyYAML or remove it.
if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
if offset:
query = query.offset(offset)if filters:
for key, value in filters.items():
query = query.filter(getattr(self.__model__, key) == value)
return query.scalar()
finally:62/62 vendors flagged this skill as clean.