Security audit
Security checks across malware telemetry and agentic risk
The skill’s company-reporting purpose is mostly coherent, but it needs review because it can auto-register accounts, fingerprint the device, persist credentials and reports, and expose signed links or contact data.
Review before installing. Use this skill only if you are comfortable with a vendor-backed company-intelligence workflow that may create a trial account, send a hashed device identifier after consent, store an API key locally, save reports to disk, and include signed platform links or contact information in outputs. Prefer preconfiguring ZLBX_API_KEY to avoid auto-registration, avoid sharing exported HTML unless you have checked it for signed links and contact data, and use contact lookup only for legitimate business purposes.
> ### ⚠️ 请求体必须用 JSON 序列化函数生成，不要手拼字符串 > > 用 `json.dumps(payload)` / `requests.post(url, json=payload)` / `JSON.stringify(payload)`， > 或 `curl -d @file`；**不要用字符串拼接，也不要用 Python 的 `str(dict)`** > （后者产出单引号，服务端会报 `Expecting property name enclosed in double quotes`）。 >
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
