Security audit
Security checks for vulnerabilities and agentic risk
This skill does send content to external services and stores a local device ID, but those behaviors are disclosed, purpose-aligned, and user-controlled rather than hidden or destructive.
Install only if you are comfortable sending generated questions plus a persistent device ID to the Xiawenxiada endpoint. Do not configure Discord, Feishu, Telegram, or WeCom notifications unless answer contents are acceptable to share with those services, and keep webhook URLs and bot tokens out of logs and source control. Delete ~/.xwd_device_id or set XWD_DEVICE_ID yourself if you want to rotate the identifier.
v = open(p, "r", encoding="utf-8").read().strip()
if v:
return v
raise RuntimeError("missing deviceId: set XWD_DEVICE_ID or run push script once to create ~/.xwd_device_id")
def post_json(url, payload, timeout=12, headers=None):chat_id = _env("TELEGRAM_CHAT_ID")
if not token or not chat_id:
return False
api = f"https://api.telegram.org/bot{token}/sendMessage"
payload = {"chat_id": chat_id, "text": text}
data = urllib.parse.urlencode(payload).encode("utf-8")
req = urllib.request.Request(No suspicious patterns detected.