Security audit
Security checks across malware telemetry and agentic risk
This skill performs the promised archival workflow, but it also reuses browser sessions, extracts cookies, reads local tokens, and uploads content using external credentials in ways that deserve careful review.
Install only if you intentionally want an agent to reuse logged-in browser sessions, access browser cookies, read Lexiang-related local credentials, and upload archived content/media to Lexiang. Use a dedicated browser profile and least-privilege Lexiang credentials, avoid running it on unrelated private sessions, and review logs because token material may be partially printed.
start_script = Path.home() / ".fetch_article" / "start-cdp-chrome.sh"
if start_script.exists():
print(f"🚀 调用 {start_script} 启动 CDP Chrome...")
subprocess.run(["bash", str(start_script)], check=False)
else:
if not _launch_cdp_chrome_via_open(port):
return False# On macOS, cookies are encrypted. We need to decrypt them.
# Get the Chrome Safe Storage key from Keychain
try:
result = subprocess.run(
[
"security",
"find-generic-password",def load_token():
"""从 ~/.cursor/mcp.json 读取乐享 MCP token（去掉 Bearer 前缀）。"""
p = os.path.expanduser("~/.cursor/mcp.json")
d = json.load(open(p))
auth = d["mcpServers"]["lexiang"]["headers"]["Authorization"]def get_chrome_cookies_for_domain(domain: str) -> list[dict]:
"""Extract cookies for a domain from Chrome's cookie database.
On macOS, Chrome encrypts cookies with the Keychain.
We use a simpler approach: copy the Cookies db and read what we can,
or use the `security` command to decrypt.
"""return []
# On macOS, cookies are encrypted. We need to decrypt them.
# Get the Chrome Safe Storage key from Keychain
try:
result = subprocess.run(
[Automatically detects and waits for Cloudflare JS challenges. 2. **Cookie injection mode** (default): Reads cookies from Chrome's cookie database and injects them into a fresh Playwright browser context. Works for most sites but Google login pages and Cloudflare-protected sites may detect the automation and block it.
print("📋 获取视频信息...")
cmd = ["yt-dlp", "--dump-json", "--no-download"]
if cookies_from_browser:
cmd.extend(["--cookies-from-browser", cookies_from_browser])
cmd.append(url)
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode != 0:61/61 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution