Security audit
Security checks across malware telemetry and agentic risk
This skill has a plausible daily lyric-reminder purpose, but it ships with hardcoded email credentials and a fixed recipient, so running it as-is could send messages through someone else's account.
Do not run or schedule this skill as-is. Remove and rotate the exposed SMTP credential if it is yours, replace hardcoded sender and recipient values with your own secure configuration, preview the outgoing email before first send, and only add the cron job after you understand how to disable it.
# 使用 agent-browser 打开百度百科
cmd = f'agent-browser open "{song_url}"'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
print(f"Result: {result.stdout}")
# 等待页面加载64/64 vendors flagged this skill as clean.
No suspicious patterns detected.