Security audit
Security checks for vulnerabilities and agentic risk
This is advertised as a DuckDuckGo search skill, but it depends on a different third-party service and stores an API key locally.
Review carefully before installing. Only use it if you trust xiaobenyang.com with your search queries, fetched URLs, and XBY API key, and be aware that the key is stored in a local .env file in plaintext. The package should be corrected to align its name, docs, code, credential handling, and dependency pinning before broad use.
default_year: int = 2025
def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")
for line in content.splitlines():def save_api_key_to_env(api_key: str) -> bool:
"""将API key保存到.env文件"""
try:
env_path = Path(".env")
lines = []
if env_path.exists():
lines = env_path.read_text(encoding="utf-8").splitlines()def set_api_key(api_key: str) -> bool:
"""设置API key并持久化到.env"""
if not api_key or not api_key.strip():
return False
api_key = api_key.strip()requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
No suspicious patterns detected.