Security audit
Security checks across malware telemetry and agentic risk
This flight-search skill is mostly coherent, but it handles login cookies and uses stealthy browser automation in ways users should review carefully before installing.
Install only if you are comfortable with an agent launching and controlling Chrome, querying third-party travel sites, and storing travel-site login cookies on disk. Use a separate browser profile and secondary travel accounts, do not reuse sensitive accounts, delete ~/.qvxian and ~/.qvxianjiuguo when done, and avoid enabling debug HTML capture unless you accept that page contents may be saved locally.
def run_cli(args: str) -> tuple[dict, int]:
"""运行 CLI 命令并返回 JSON 结果和退出码"""
cmd = f'uv run python -m qvxianjiuguo.cli {args}'
result = subprocess.run(
cmd,
shell=True,
capture_output=True,64/64 vendors flagged this skill as clean.
No suspicious patterns detected.