Security checks across malware telemetry and agentic risk
This skill mostly matches a PR review automation purpose, but it ships hard-coded GitCode credentials and some automation can mark or comment on PRs without a real completed review.
Install only after removing and rotating the embedded GitCode token, confirming the skill uses your own least-privilege token from environment or config, and disabling scheduled/bulk review until you verify it performs real analysis before posting comments or marking PRs reviewed.
"""调用 GitCode API"""
sep = '&' if '?' in url else '?'
cmd = f'curl -s "{url}{sep}access_token={TOKEN}&per_page=100"'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=10)
if result.returncode != 0:
return None
try:# 使用access_token参数而非Bearer token，因为Bearer方式会截断评论列表
sep = '&' if '?' in url else '?'
cmd = f'curl -s "{url}{sep}access_token={TOKEN}&per_page=100"'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
try:
return json.loads(result.stdout)
except:64/64 vendors flagged this skill as clean.