secondme-dev-assistant

SUSPICIOUS: The skill’s core SecondMe developer workflow is coherent, but its footprint extends into transitive skill installation, silent pre-flight updates, local credential/secret handling, and telemetry collection/sync. Data flows mostly match the stated platform purpose and hosts, yet the combination of autonomous background behavior and transitive trust makes it medium risk rather than benign.

This is an intentional telemetry synchronization implementation rather than evident malware. It collects local analytics and sends them, together with a bearer token, to a configurable endpoint. Anonymous-mode field filtering is present in prepare_event, but the unused stripping constant and unrestricted baseUrl make configuration integrity important. Use of a non-HTTPS or attacker-controlled baseUrl could expose credentials and telemetry. Additional reliability issues can cause dropped or duplicated events, but they are not direct malicious behavior.