cnki-advanced-search
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage a Google Chrome instance with the remote debugging port enabled (
--remote-debugging-port=9222). It also usescurlto verify the connection to the Chrome DevTools Protocol (CDP) on localhost. These are standard operations for automating a browser where a user may already be logged in.- [DYNAMIC_EXECUTION]: A Python script template is provided inSKILL.md(Step 3.1) which the agent is expected to execute to merge and format Excel results. The script uses theopenpyxllibrary to process local files and create a categorized summary. This is a legitimate functional component of the skill's workflow.- [DATA_EXFILTRATION]: The skill and its associated scripts contain hardcoded absolute file paths referencing a specific local directory structure (/Users/songyiping/). While this reveals the local username of the original environment, it is used for locating the skill's own assets and saving output to the standard Downloads folder, posing no significant security risk.
Audit Metadata