Security audit
Security checks for vulnerabilities and agentic risk
This literature-review skill is not clearly malicious, but it asks for and stores an API key locally while showing mismatched third-party and gaokao-related wiring that users should review carefully.
Install only if you are comfortable giving a XiaoBenYang API key to this skill and having it saved in a local plaintext .env file. Review or remove the gaokao-related documentation drift before relying on it, and prefer using a limited-scope API key that can be revoked.
default_year: int = 2025
def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")def model_post_init(self, __context):
# 强制从 .env 文件读取 XBY_APIKEY
env_path = Path(".env")
if env_path.exists():
content = env_path.read_text(encoding="utf-8")
for line in content.splitlines():def save_api_key_to_env(api_key: str) -> bool:
"""将API key保存到.env文件"""
try:
env_path = Path(".env")
lines = []
if env_path.exists():
lines = env_path.read_text(encoding="utf-8").splitlines()def set_api_key(api_key: str) -> bool:
"""设置API key并持久化到.env"""
if not api_key or not api_key.strip():
return False
api_key = api_key.strip()requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
No suspicious patterns detected.