Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly a Bilibili AI report generator, but its optional subscription mode and investigation instructions create review-worthy privacy and credential risks.
Review before installing if you plan to use subscription mode or provide a real RedFox API key. Avoid enabling --subscribe until plaintext key storage and crontab/LaunchAgent behavior are fixed, and treat the bundled person-background and litigation investigation guidance as out of scope unless you explicitly need that capability and have appropriate authorization.
plist_path.write_text(plist_content, encoding="utf-8")
try:
subprocess.run(["launchctl", "load", str(plist_path)], check=True, capture_output=True)
info("订阅成功! 每天 09:00 自动生成B站爆款日报")
info(f"日报目录: ~/Downloads/QoderReports/")
info(f"日志: {log_path}")script_path = os.path.abspath(__file__)
cron_line = f"0 9 * * * /usr/bin/python3 {script_path} --no-open"
try:
subprocess.run(
f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
shell=True, check=True, capture_output=True
)else:
script_path = os.path.abspath(__file__)
try:
subprocess.run(
f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
shell=True, check=True, capture_output=True
)48/48 vendors flagged this skill as clean.
No suspicious patterns detected.