Security audit
Security checks across malware telemetry and agentic risk
This looks like a real Miaoda app-builder skill, but it needs Review because it can use ambient host session credentials and deploy public apps without strong explicit consent controls.
Install only if you intend to let this skill act on your Miaoda account, including creating, modifying, generating, and publishing apps. Avoid giving it ambient desktop session access unless you trust that environment, confirm before any publish/generate action, and keep `MIAODA_API_KEY` out of chat, logs, and shell history where possible.
"MIAODA_BASE_URL", f"https://{API_SERVER_HOST}{MIAODA_PROXY_PATH}"
)
# Satisfy the CLI's required-key check; the proxy authenticates by session.
os.environ["MIAODA_API_KEY"] = "api-server-managed"
extra_headers = {
"X-Dumate-Session-Id": session_id,def _install_sandbox_auth_hooks() -> None:
"""Use qianfan-desk's session proxy when no Miaoda key is available."""
if os.environ.get("MIAODA_API_KEY") or _has_cli_api_key():
return
session_id = os.environ.get("DUMATE_SESSION_ID")"X-Dumate-Session-Id": session_id,
"X-Appbuilder-Dumate-Account-Id": account_id,
}
dtoken = os.environ.get("DUMATE_DTOKEN")
if dtoken:
extra_headers["Authorization"] = f"Bearer {dtoken}"app_id: str,
fetch_timeout: int = 10,
) -> Optional[str]:
"""Extract the conversationId (contextId) for an existing app by reading its trajectory.
Scans ALL trajectory events and returns the MOST RECENT (last) non-empty contextId
found, checking two paths per event:VirusTotal findings are pending for this skill version.
No suspicious patterns detected.