Security audit
Security checks for vulnerabilities and agentic risk
This GSAP animation skill is not clearly malicious, but it needs Review because it sends user prompts and code to an external service while collecting and storing an API key in a local .env file, with several stale Gaokao/school-search remnants that make its scope unclear.
Install only if you are comfortable giving this publisher an XBY API key and sending animation prompts or source code to the XiaoBenYang remote API. Avoid pasting proprietary code, secrets, internal URLs, or customer data unless the publisher provides clear privacy, retention, and key-handling terms; consider using a dedicated low-privilege API key and removing the local .env entry when finished.
model_config = SettingsConfigDict(
env_prefix="XBY_GAOKAO_",
env_file=".env",
env_file_encoding="utf-8",
extra="ignore",
)default_year: int = 2025
def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")
for line in content.splitlines():if line.startswith("XBY_APIKEY="):
self.api_key = line.split("=", 1)[1].strip()
break
# 如果环境变量有值，覆盖 .env 的值
env_val = os.getenv("XBY_APIKEY", "")
if env_val:
self.api_key = env_valdef save_api_key_to_env(api_key: str) -> bool:
"""将API key保存到.env文件"""
try:
env_path = Path(".env")
lines = []
if env_path.exists():
lines = env_path.read_text(encoding="utf-8").splitlines()def set_api_key(api_key: str) -> bool:
"""设置API key并持久化到.env"""
if not api_key or not api_key.strip():
return False
api_key = api_key.strip()requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
No suspicious patterns detected.