Security audit
Security checks for vulnerabilities and agentic risk
The skill is a website-copying guide whose main behavior is disclosed, but it asks users to place active session data in configuration and gives anti-crawling bypass advice without adequate safety boundaries.
Review carefully before installing. Use this only for sites you own or are authorized to copy, keep output in a dedicated directory, set conservative depth and page limits, and avoid putting real cookies or localStorage session values into plaintext configuration unless you are prepared to protect and rotate those credentials.
The session section instructs users to supply cookies and localStorage values for authenticated crawling, but it omits any privacy or credential-handling warning. That creates a real risk of exposing active session secrets in config files, logs, shell history, or generated artifacts, potentially allowing account takeover or unauthorized access if those values are mishandled.
The skill explicitly promises one-click replication of arbitrary websites and describes downloading HTML, CSS, JS, images, fonts, and media to local storage, but it does not warn users about potentially large disk consumption or mass local writes. This can lead users to unintentionally fill storage, overwrite expected workspace contents, or trigger downstream handling of large untrusted web assets without informed consent.
The interactive prompt examples are written entirely in Chinese and the skill description does not indicate that language selection is optional or that the tool is intentionally limited to a Chinese-only context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
No suspicious patterns detected.
