Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to call an external image-recognition service, but it stores an API key in a local .env file and contains unrelated leftover Gaokao references that warrant review before installation.
Install only if you are comfortable giving this skill a XiaoBenYang API key, storing that key in a local plaintext .env file, and sending image URLs or full base64 image data to the external provider. Avoid using sensitive personal or confidential images unless you trust the provider and have checked its data handling terms.
default_year: int = 2025
def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")
for line in content.splitlines():def save_api_key_to_env(api_key: str) -> bool:
"""将API key保存到.env文件"""
try:
env_path = Path(".env")
lines = []
if env_path.exists():
lines = env_path.read_text(encoding="utf-8").splitlines()def set_api_key(api_key: str) -> bool:
"""设置API key并持久化到.env"""
if not api_key or not api_key.strip():
return False
api_key = api_key.strip()requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
No suspicious patterns detected.