Security checks across malware telemetry and agentic risk
The skill appears to be a real publishing and AI writing tool, but it stores account secrets and can transmit or publish user content with weaker disclosure and controls than its authority warrants.
Install only if you are comfortable giving this skill high-value publishing credentials and sending drafts/prompts to third-party services. Prefer environment variables or a restricted account, avoid confidential drafts, verify whether each platform action creates a private draft or public post, and avoid untrusted remote CSS/image URLs.
async def _call_openai(self, system_prompt: str, user_content: str) -> str:
"""调用 OpenAI API"""
base_url = self.config.base_url or "https://api.openai.com/v1"
response = await self._client.post(
f"{base_url}/chat/completions",async def _call_anthropic(self, system_prompt: str, user_content: str) -> str:
"""调用 Anthropic API"""
response = await self._client.post(
"https://api.anthropic.com/v1/messages",
headers={
"x-api-key": self.config.api_key,
"anthropic-version": "2023-06-01",VirusTotal findings are pending for this skill version.