iconfont-downloader

SUSPICIOUS: The skill’s purpose and capabilities mostly align with icon search/download, and there is no obvious supply-chain or malware behavior. However, it solicits raw credentials and routes them through opaque custom tools with undocumented endpoints, so credential handling and actual data flow cannot be independently verified.

The code appears intended to automate Iconfont searches and downloads, not to install malware. However, it logs login credentials, may send session cookies to an arbitrary svgUrl, and allows insufficiently constrained output paths or filenames. These are concrete security risks that should be addressed.

The fragment shows no clear malware behavior, but it contains material security risks: login inputs are logged, an arbitrary svgUrl can receive the stored session cookie, and download path parameters are insufficiently constrained. Treat the URL and filesystem issues as potentially exploitable depending on who can invoke the tool and control its inputs.