Security audit
Security checks across malware telemetry and agentic risk
The skill’s core report generation is coherent, but its subscription feature creates persistent scheduled jobs and can store an API key on disk without clear disclosure.
Install only if you are comfortable giving the skill a RedFox API key and letting it contact redfox.hk and write reports under ~/Downloads/QoderReports. Avoid --subscribe unless you have reviewed the LaunchAgent or crontab behavior; on macOS it may store REDFOX_API_KEY in a plist file. Treat generated HTML reports as containing untrusted remote content.
script_path = os.path.abspath(__file__)
cron_line = f"0 16 * * * /usr/bin/python3 {script_path} --no-open"
try:
subprocess.run(
f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
shell=True, check=True, capture_output=True
)else:
script_path = os.path.abspath(__file__)
try:
subprocess.run(
f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
shell=True, check=True, capture_output=True
)log_path = str(Path.home() / "Library" / "Logs" / "qoder-xhs-ai-feed.log")
env_section = ""
api_key = os.environ.get(ENV_KEY, "").strip()
if api_key:
env_section = f"""
<key>EnvironmentVariables</key>else:
script_path = os.path.abspath(__file__)
try:
subprocess.run(
f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -',
shell=True, check=True, capture_output=True
)cron_line = f"0 16 * * * /usr/bin/python3 {script_path} --no-open"
try:
subprocess.run(
f'(crontab -l 2>/dev/null; echo "{cron_line}") | crontab -',
shell=True, check=True, capture_output=True
)
info("订阅成功! 每天 16:00 自动生成小红书 AI 日报 (crontab)")def install_subscription():
"""安装定时任务，每天自动生成日报"""
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)"""安装定时任务，每天自动生成日报"""
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-xhs-ai-feed.log")"""安装定时任务，每天自动生成日报"""
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-xhs-ai-feed.log")"""安装定时任务，每天自动生成日报"""
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-xhs-ai-feed.log")"""安装定时任务，每天自动生成日报"""
if sys.platform == "darwin":
PLIST_DIR.mkdir(parents=True, exist_ok=True)
plist_path = PLIST_DIR / f"{PLIST_LABEL}.plist"
script_path = os.path.abspath(__file__)
log_path = str(Path.home() / "Library" / "Logs" / "qoder-xhs-ai-feed.log")<string>{api_key}</string>
</dict>"""
plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict></dict>"""
plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key></dict>"""
plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>plist_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>{PLIST_LABEL}</string><plist version="1.0">
<dict>
<key>Label</key>
<string>{PLIST_LABEL}</string>
<key>ProgramArguments</key>
<array>
<string>/usr/bin/python3</string><key>RunAtLoad</key>
<false/>{env_section}
</dict>
</plist>'''
plist_path.write_text(plist_content, encoding="utf-8")</dict>
</plist>'''
plist_path.write_text(plist_content, encoding="utf-8")
try:
subprocess.run(["launchctl", "load", str(plist_path)],</dict>
</plist>'''
plist_path.write_text(plist_content, encoding="utf-8")
try:
subprocess.run(["launchctl", "load", str(plist_path)],plist_path.write_text(plist_content, encoding="utf-8")
try:
subprocess.run(["launchctl", "load", str(plist_path)],
check=True, capture_output=True)
info("订阅成功! 每天 16:00 自动生成小红书 AI 日报")
info(f"日报目录: ~/Downloads/QoderReports/")VirusTotal findings are pending for this skill version.
No suspicious patterns detected.