cnki-advanced-search

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to manage a Google Chrome instance with the remote debugging port enabled (--remote-debugging-port=9222). It also uses curl to verify the connection to the Chrome DevTools Protocol (CDP) on localhost. These are standard operations for automating a browser where a user may already be logged in.- [DYNAMIC_EXECUTION]: A Python script template is provided in SKILL.md (Step 3.1) which the agent is expected to execute to merge and format Excel results. The script uses the openpyxl library to process local files and create a categorized summary. This is a legitimate functional component of the skill's workflow.- [DATA_EXFILTRATION]: The skill and its associated scripts contain hardcoded absolute file paths referencing a specific local directory structure (/Users/songyiping/). While this reveals the local username of the original environment, it is used for locating the skill's own assets and saving output to the standard Downloads folder, posing no significant security risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 09:04 AM