Security audit
Security checks across malware telemetry and agentic risk
The skill largely matches its A-share market-report purpose, but it deserves review because it uses broad local credential lookup and disables proxy environment settings while making third-party network calls.
Install only if you are comfortable giving the skill access to market-data API credentials, a PostgreSQL/alpha-data database, report-file writes, and outbound network access to the listed data/search providers. Prefer setting credentials explicitly in the runtime environment, avoid running it from directories with unrelated .env files, and review proxy/egress expectations before using the daily runner.
payload["exclude_domains"] = exclude_domains
try:
resp = requests.post(TAVILY_ENDPOINT, json=payload, timeout=30)
except requests.RequestException as exc:
return {
"query": query,def get_tavily_key() -> str:
"""TAVILY_API_KEY：优先环境变量，否则就近的 .env（cwd 或脚本上溯的仓库根）。"""
key = os.environ.get("TAVILY_API_KEY", "").strip()
if key:
return key"pageNum": page_num,
"pageSize": page_size,
}
response = requests.post(JRJ_LIMIT_UP_URL, headers=headers, json=payload, timeout=15)
response.raise_for_status()
data = response.json()
if not isinstance(data, dict) or data.get("code") != 20000:def _read_key_from_env_file(path: Path) -> str:
"""从单个 .env 文件里读 TAVILY_API_KEY（容错，读不到返回空串）。"""
try:
with open(path, "r", encoding="utf-8") as fh:
for line in fh:if key:
return key
candidates = [Path.cwd() / ".env"]
here = Path(__file__).resolve()
candidates += [parent / ".env" for parent in list(here.parents)[:6]]candidates = [Path.cwd() / ".env"]
here = Path(__file__).resolve()
candidates += [parent / ".env" for parent in list(here.parents)[:6]]
seen: set[Path] = set()
for cand in candidates:if token:
return token
env_path = os.path.join(os.getcwd(), ".env")
if not os.path.exists(env_path):
return ""65/65 vendors flagged this skill as clean.
No suspicious patterns detected.