Security audit
Security checks across malware telemetry and agentic risk
This skill is a powerful agent orchestration library, but it needs review because it can run generated code and write files with the user's normal system permissions.
Review before installing. Use this only in an isolated workspace or container, with least-privilege environment variables, no sensitive files in scope, and explicit allowlists for tools. Treat Code Mode as arbitrary code execution, not a sandbox, and require separate confirmation for network calls, file writes, PowerShell, and any generated code.
// Tavily 搜索
orchestrator.registerTool('tavily-search',
async (params) => {
const res = await fetch('https://api.tavily.com/search', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({// Tavily 搜索
orchestrator.registerTool('tavily-search',
async (params) => {
const res = await fetch('https://api.tavily.com/search', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({timeout: options.timeout || 300000, // 5 分钟
onTimeout: options.onTimeout || null,
// 自动批准模式（白名单）
autoApprove: options.autoApprove || [],
// 日志
verbose: options.verbose || false,
};timeout: options.timeout || 300000, // 5 分钟
onTimeout: options.onTimeout || null,
// 自动批准模式（白名单）
autoApprove: options.autoApprove || [],
// 日志
verbose: options.verbose || false,
};if (!this.options.enabled) return false;
// 白名单：自动批准
if (this.options.autoApprove.includes(toolName)) {
this.log(`✅ 自动批准：${toolName} (白名单)`);
return false;
}66/66 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec