Security checks across malware telemetry and agentic risk
The certificate tool mostly does what it claims, but the package also includes an unrelated Gitee publishing script with a hardcoded token and privileged automation surfaces that need review before use.
Review before installing. Remove upload_skill.py from the package, rotate or revoke the exposed Gitee token if it is real, use a least-privilege Baidu DNS key limited to the target zone, protect config.conf and the skill directory from untrusted writes, avoid RENEW_HOOK unless the command is fully trusted, and run scheduled renewal under the least-privileged account that can perform the task rather than SYSTEM where possible.
renew_hook = cfg.get("RENEW_HOOK", "").strip()
if renew_hook:
log.info("执行续期钩子: %s", renew_hook)
ret = subprocess.run(renew_hook, shell=True)
if ret.returncode != 0:
log.warning("续期钩子执行失败（返回码 %d）", ret.returncode)time.sleep(1)
if sha:
r = requests.put(
f'https://gitee.com/api/v5/repos/{REPO_FULL}/contents/{fname}',
json=data, headers=headers, verify=False, timeout=30
)json=data, headers=headers, verify=False, timeout=30
)
else:
r = requests.post(
f'https://gitee.com/api/v5/repos/{REPO_FULL}/contents/{fname}',
json=data, headers=headers, verify=False, timeout=30
)64/64 vendors flagged this skill as clean.