china-law-search

整体目的与主要能力大体一致：这是一个面向官方中国法规库的查询/下载技能，网络目标也基本限于官方政府域名。主要风险来自为绕过动态认证而安装并调用 Playwright、拦截并缓存 athenaappkey，以及允许代理自动修改 skill 文件；这些行为使其比普通检索技能更高风险，但当前证据不足以认定为恶意。

The code is primarily a regulations-search/scraping utility. However, it exhibits high supply-chain risk and credential-handling concerns: it auto-installs a global Node.js package (@playwright/cli) at runtime via npm and executes playwright-cli to harvest an 'athenaappkey' from browser output, then caches that key locally and reuses it in Authorization-like headers. There is no clear malware payload (no reverse shell/crypto/keylogging), and the code is mostly readable (no intentional obfuscation). Overall, treat as a security-sensitive package and review/lock dependency versions and execution behavior.

This code fragment performs targeted interception of a custom, credential-like request header ('athenaappkey') from matching requests and then exposes the captured value by writing it into document.title ('GOVKEY:<value>'). Even without explicit network exfiltration in the snippet, the behavior is strongly consistent with credential/secret harvesting and leakage through observable page metadata. Surrounding context is not provided, so malicious intent cannot be proven with certainty, but the security risk is high and warrants removal/review.