Security audit
Security checks across malware telemetry and agentic risk
This finance news skill is mostly purpose-aligned, but it has under-scoped automatic deletion, credential/profile use, and external command execution risks that users should review before installing.
Install only if you are comfortable with the skill making outbound requests to finance sites and model APIs, writing local reports/logs, opening generated HTML, and using configured credentials. Before running it, set temp/report paths to dedicated disposable directories, avoid pointing cookie_path at a real browser profile unless needed, remove API key logging, and review the shell=True subprocess paths.
print(f" 执行summarize命令: {' '.join(cmd[:3])}...")
print(f" 使用API base URL: {api_base_url}")
result = subprocess.run(
cmd,
capture_output=True,
text=True,# 检查summarize命令是否可用
try:
import subprocess
result = subprocess.run(['summarize', '--version'],
capture_output=True, text=True, timeout=5, shell=True)
summarize_available = result.returncode == 0
except Exception:print(f" 环境变量: OPENAI_API_KEY={deepseek_api_key[:10]}...{deepseek_api_key[-4:] if deepseek_api_key else '未设置'}")
print(f" OPENAI_BASE_URL={deepseek_base_url}")
result = subprocess.run(
cmd,
capture_output=True,
text=True,# 计算超时时间（秒），使用配置的超时时间
timeout_seconds = timeout_ms / 1000 + 5 # 增加5秒缓冲
result = subprocess.run(
cmd,
shell=True,
capture_output=True,env['OPENAI_API_KEY'] = self.default_config['api_key']
env['OPENAI_BASE_URL'] = self.default_config['api_base_url']
result = subprocess.run(
cmd,
capture_output=True,
text=True,if cmd.endswith('.ps1'):
# 使用PowerShell调用
powershell_cmd = ["powershell", "-Command", f"& {cmd} --version"]
result = subprocess.run(
powershell_cmd,
capture_output=True,
text=True,timeout=5
)
else:
result = subprocess.run(
[cmd, "--version"],
capture_output=True,
text=True,64/64 vendors flagged this skill as clean.
No suspicious patterns detected.