Security audit
Security checks across malware telemetry and agentic risk
The skill openly searches ebook sites, but it has Review-level concerns because it can surface download links, automatically contact many third-party services, and implicitly use a local WeRead API key if present.
Install only if you intend the agent to search external ebook sources and return third-party download links. Be aware that ordinary book requests may trigger network lookups, search terms may be sent to Anna's Archive and several Chinese book platforms, and a WEREAD_API_KEY in the environment may be used automatically unless the agent runs with --no-weread or the variable is absent. Use it only for lawful access to content you are authorized to obtain.
print(f'\n━━━ 测试: {name} ━━━')
print(f'命令: {cmd}')
try:
r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=60)
output = r.stdout + r.stderr
if r.returncode != 0:
print(f'❌ 失败 (返回码 {r.returncode})')@staticmethod
def check_weread(title, author=""):
"""查询微信读书上架情况"""
api_key = os.environ.get('WEREAD_API_KEY', '')
if not api_key:
return Noneprint(f'\n━━━ 测试: {name} ━━━')
print(f'命令: {cmd}')
try:
r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=60)
output = r.stdout + r.stderr
if r.returncode != 0:
print(f'❌ 失败 (返回码 {r.returncode})')65/65 vendors flagged this skill as clean.
No suspicious patterns detected.