Security audit
Security checks across malware telemetry and agentic risk
This is a real blog-authoring tool, but it exposes high-impact publish/delete/file operations and local credential/process access with weak scoping and disclosure.
Review carefully before installing. Only run it in a trusted local environment, do not expose its web server to a network, and expect it to read/write your Jekyll posts, run git commands, push to GitHub Pages, call external research/AI services, and look for a hard-coded MiniMax API key path.
return content[m.end():] if m else content
def git_run(*args, cwd=BLOG_DIR):
r = subprocess.run(["git"] + list(args), cwd=cwd, capture_output=True, text=True, timeout=30)
return r.returncode == 0, r.stdout.strip(), r.stderr.strip()
def markdown_to_html(text):f"&srsearch={urllib.parse.quote(topic)}&srlimit=6&format=json"
f"&prop=extracts&exintro=1&explaintext=1")
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0 (Sol Blog Composer)"})
with urllib.request.urlopen(req, timeout=10) as res:
data = json.loads(res.read())
for r in data.get("query", {}).get("search", []):
snippet = re.sub(r'<[^>]+>', '', r.get("snippet", ""))data=data, headers=headers, method="POST"
)
try:
with urllib.request.urlopen(req, timeout=120) as res:
result = json.loads(res.read())
# MiniMax returns content as a list of blocks (thinking + text)
text_parts = []f"&srsearch={urllib.parse.quote(topic)}&srlimit=6&format=json"
f"&prop=extracts&exintro=1&explaintext=1")
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0 (Sol Blog Composer)"})
with urllib.request.urlopen(req, timeout=10) as res:
data = json.loads(res.read())
for r in data.get("query", {}).get("search", []):
snippet = re.sub(r'<[^>]+>', '', r.get("snippet", ""))data=data, headers=headers, method="POST"
)
try:
with urllib.request.urlopen(req, timeout=120) as res:
result = json.loads(res.read())
# MiniMax returns content as a list of blocks (thinking + text)
text_parts = []f"&prop=extracts&exintro=1&explaintext=1"
)
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0 (Sol Blog Composer)"})
with urllib.request.urlopen(req, timeout=10) as res:
data = json.loads(res.read())
results = data.get("query", {}).get("search", [])
if results:f"&prop=extracts&exintro=1&explaintext=1"
)
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0 (Sol Blog Composer)"})
with urllib.request.urlopen(req, timeout=10) as res:
data = json.loads(res.read())
results = data.get("query", {}).get("search", [])
if results:def do_http():
try:
with urllib.request.urlopen(req, timeout=120) as res:
result = json.loads(res.read())
content = result["content"][0]["text"].strip()
gen_state["text"] = contentdef do_http():
try:
with urllib.request.urlopen(req, timeout=120) as res:
result = json.loads(res.read())
content = result["content"][0]["text"].strip()
gen_state["text"] = content65/65 vendors flagged this skill as clean.