Security audit
Security checks for vulnerabilities and agentic risk
This skill appears benign: it extracts website media through a disclosed external API and does not install code, persist itself, or request unusual local privileges.
Before installing, consider that page URLs will be sent to MiroMiro's API, use may consume credits, and render mode runs the target page in a remote browser. Also review rights before reusing extracted logos, photos, audio, or video.
The activation guidance says to use the skill when the user asks to "grab, download, recover, list, or find assets on a website." Several of these phrases are broad and could match ordinary requests without clearly delimiting when this skill should or should not activate. The description does not provide exclusion conditions or negative examples to narrow invocation scope.
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
## Result caps
Remote results are trimmed so a large page cannot flood the context, and every trimmed
response states what was dropped. Two optional arguments loosen it:
- `limit` — raise the item cap, up to 200
No suspicious patterns detected.