Security audit
Security checks across malware telemetry and agentic risk
The skill's main report-generation purpose is coherent, but its optional subscription path creates persistent scheduled jobs and can store an API key on disk without enough safeguards.
Review this skill before installing. Normal one-off report generation appears aligned with its purpose, but avoid using the daily subscription feature unless you are comfortable with it modifying LaunchAgents or crontab. Use a revocable RedFox API key, avoid storing high-value credentials in the environment on macOS with --subscribe, and prefer running reports manually or with your own scheduler until the subscription flow adds explicit confirmation, safer crontab handling, HTML escaping, and clearer cleanup instructions.
script_path = os.path.abspath(__file__)
cron_line = f"0 9 * * * /usr/bin/python3 {script_path} --keyword {keyword} --no-open"
try:
subprocess.run(
f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
shell=True, check=True, capture_output=True
)else:
script_path = os.path.abspath(__file__)
try:
subprocess.run(
f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
shell=True, check=True, capture_output=True
)def get_api_key(cli_key=None):
if cli_key:
return cli_key
env_key = os.environ.get(ENV_KEY)
if env_key:
return env_key
if CONFIG_FILE.exists():log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-bilibili-feed.log")
env_section = ""
api_key = os.environ.get(ENV_KEY)
if api_key:
env_section = (
'\n <key>EnvironmentVariables</key>'else:
script_path = os.path.abspath(__file__)
try:
subprocess.run(
f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
shell=True, check=True, capture_output=True
)<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>文旅B站信息源 - {{KEYWORD}} - {{DATE}}</title>
<!-- Fonts: Archivo Black (display) + Space Grotesk (body) -->
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Archivo+Black&family=Space+Grotesk:wght@300;400;500;600;700&display=swap" rel="stylesheet">cron_line = f"0 9 * * * /usr/bin/python3 {script_path} --keyword {keyword} --no-open"
try:
subprocess.run(
f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
shell=True, check=True, capture_output=True
)
info(f"订阅成功! 每天 09:00 自动生成「{keyword}」文旅B站日报 (crontab)")script_path = os.path.abspath(__file__)
try:
subprocess.run(
f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
shell=True, check=True, capture_output=True
)
info("已取消订阅，crontab 任务已移除")# ─── 订阅机制 ──────────────────────────────────────────────────────────────────────
def install_subscription(keyword):
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-bilibili-feed.log")def install_subscription(keyword):
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-bilibili-feed.log")def install_subscription(keyword):
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-bilibili-feed.log")def install_subscription(keyword):
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-bilibili-feed.log")def install_subscription(keyword):
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-cultural-tourism-bilibili-feed.log")'\n </dict>'
)
plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>)
plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>45/45 vendors flagged this skill as clean.