kuaipu-skill
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions in
README.mdandSKILL.mdrequire users to store sensitive login credentials (kuaipu_user,kuaipu_pass) in a local.envfile. Storing credentials in plain text on the file system poses a risk of exposure if the environment is not properly secured. - [EXTERNAL_DOWNLOADS]: The skill uses the
webdriver-managerpackage to automatically download Chrome browser drivers from the internet. Additionally, the installation steps inREADME.mdandSKILL.mdinstruct users to download theddddocrlibrary, which is used for captcha recognition. These external dependencies involve fetching and executing code from remote sources. - [DATA_EXPOSURE]: The script
kuaipu_skill.pysaves session cookies totmp/kuaipu_cookies.pkland takes screenshots of the application pages, storing them in a localtmpdirectory. While these files are stored locally for automation and debugging, they contain sensitive session information and application data.
Audit Metadata