Security audit
Security checks across malware telemetry and agentic risk
DataPulse is mostly a real content-collection skill, but it includes under-disclosed local secret access, authenticated stealth browsing, and configurable code-execution/update paths that warrant manual review before installation.
Install only if you are comfortable giving this skill broad network, local file, browser-session, and optional subprocess authority. Before use, review and lock down environment variables, avoid setting arbitrary backend command/callable variables unless you fully trust the target, avoid storing sensitive cookies or session files unless needed, and treat self-update as a privileged manual maintenance action.
request_payload = self._build_request(url, source_type_hint, timeout_seconds)
try:
completed = subprocess.run(
command,
input=json.dumps(request_payload, ensure_ascii=True),
capture_output=True,if not module_name or not attr_name:
raise ValueError(f"Invalid factuality backend callable path: {path}")
module = importlib.import_module(module_name)
return getattr(module, attr_name)
def _call_factuality_backend(timeout_seconds = _factuality_backend_timeout_seconds()
started = time.perf_counter()
try:
completed = subprocess.run(
command,
input=json.dumps(request_payload, ensure_ascii=True),
capture_output=True,request_payload = self._build_request(url, source_type_hint, timeout_seconds)
try:
completed = subprocess.run(
command,
input=json.dumps(request_payload, ensure_ascii=True),
capture_output=True,for _ in range(2):
try:
req = urllib.request.Request(api_url, headers={"User-Agent": "Mozilla/5.0"})
with urllib.request.urlopen(req, timeout=20) as resp:
data = json.loads(resp.read().decode())
if data.get("code") != 200:
return ParseResult.failure(original_url, f"FxTwitter code {data.get('code')}: {data.get('message', 'unknown')}")66/66 vendors flagged this skill as clean.
No suspicious patterns detected.