Security audit
Security checks across malware telemetry and agentic risk
This documentation-only skill is mostly coherent, but it gives agents a pattern for running arbitrary SQL against production databases without clear confirmation or safety boundaries.
Review this skill before installing if agents may access production databases. Use it only with narrowly scoped database accounts, explicit user approval for migrations or destructive SQL, and careful handling of result files and sealed scripts.
url = f"{MGC_BASE_URL}/api/mgc/sensitive/get"
headers = {"X-MGC-Token": token, "Content-Type": "application/json"}
data = {"info_type": info_type, "info_owner": info_owner, "action": "run"}
resp = requests.post(url, json=data, headers=headers, timeout=10)
resp.raise_for_status()
result = resp.json()
if isinstance(result, str):token = f.read().strip()
url = f"{MGC_BASE_URL}/api/mgc/sensitive/get"
headers = {"X-MGC-Token": token, "Content-Type": "application/json"}
resp = requests.post(
url,
json={"info_type": info_type, "info_owner": info_owner, "action": "run"},
headers=headers,- ✅ Reference scripts by `info_owner`/`diff_1` only; never include credentials in prompts - ❌ **Never call `mgc_get`** — returns plaintext - ❌ **Never embed credentials** in SKILL.md, prompts, or AI context - ❌ **Never ask the user** to paste the password in chat ---
VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal