Security audit
Security checks across malware telemetry and agentic risk
This is a cloud-backed web research skill, but it stores an API key in a local plaintext .env file and sends user inputs to an external service without enough disclosure.
Install only if you trust the Xiaobenyang service with your searches, URLs, stack traces, package names, and other submitted context. Use a scoped or revocable API key, keep the generated .env file out of source control and backups where possible, and avoid sending private internal links, secrets, tokens, or proprietary error logs through this skill.
def save_api_key_to_env(api_key: str) -> bool:
"""将API key保存到.env文件"""
try:
env_path = Path(".env")
lines = []
if env_path.exists():
lines = env_path.read_text(encoding="utf-8").splitlines()def set_api_key(api_key: str) -> bool:
"""设置API key并持久化到.env"""
if not api_key or not api_key.strip():
return False
api_key = api_key.strip()requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
requests>=2.31.0 pydantic>=2.7.0 pydantic-settings>=2.2.0 python-dotenv>=1.0.1
65/65 vendors flagged this skill as clean.
No suspicious patterns detected.