Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public company profile data from the Indonesia Stock Exchange and does not show hidden, destructive, persistent, or credential-stealing behavior.
Reasonable to install if you are comfortable with a skill that makes live requests to the IDX website and returns English-normalized field names. For stricter environments, consider pinning dependency versions and treating the broad security/VirusTotal claims as publisher assertions rather than guarantees.
The description states that the skill 'Automatically translates all field keys from Indonesian to English,' which imposes a language transformation by default. This is a natural-language locale policy concern because the skill does not indicate any user opt-in, configurability, or justification for forcing English output.
The request headers hard-code Accept-Language: en-US,en;q=0.5, which imposes an English/US locale preference regardless of user preference or environment. This is a natural-language/locale policy concern because the skill does not document any user opt-in or justification for forcing that locale.
The dependency manifest allows any requests version at or above 2.32.5 instead of pinning to a specific known-safe release, making it impossible to verify from this file alone which version will actually be installed in different environments. While the lower bound likely avoids many older CVEs, the unpinned specification still creates supply-chain uncertainty and can unintentionally pull in a future vulnerable or incompatible release.
No suspicious patterns detected.
