Security checks across malware telemetry and agentic risk
This skill openly describes memory features, but it automatically downloads and checks extra private code in a way users should review before installing.
Install only if you are comfortable with the skill contacting cnb.cool during install/startup and placing unpinned private repository contents under the skill directory. Prefer a version that vendors or pins the private package, verifies signatures or checksums, validates install paths, and makes remote installation and startup checks explicit opt-in steps.
result["current_commit"] = current.stdout.strip()[:8]
# 获取远程最新 commit（不拉取）
subprocess.run(
["git", "fetch", "--dry-run"],
cwd=str(privileged_dir),
capture_output=True,shutil.rmtree(target_dir)
# 克隆仓库
result = subprocess.run(
["git", "clone", "--depth", "1", url, str(target_dir)],
capture_output=True,
text=True,result["current_commit"] = current.stdout.strip()[:8]
# 获取远程最新 commit（不拉取）
subprocess.run(
["git", "fetch", "--dry-run"],
cwd=str(privileged_dir),
capture_output=True,"""写入启动日志"""
log_file = skill_dir / ".privileged_status.log"
with open(log_file, "w") as f:
f.write(f"timestamp: {datetime.now().isoformat()}\n")
f.write(f"exists: {status['exists']}\n")
f.write(f"has_git: {status['has_git']}\n")"""写入安装日志"""
log_file = skill_dir / ".privileged_install.log"
with open(log_file, "w") as f:
f.write(f"timestamp: {datetime.now().isoformat()}\n")
f.write(f"architecture: {arch}\n")
f.write(f"success: {success}\n")65/65 vendors flagged this skill as clean.