Security checks across malware telemetry and agentic risk
This skill clearly aims to auto-publish Douyin articles, but it can post to a live account by default and uses an unsafe shell command path with user-influenced filenames.
Install only if you intentionally want an agent to generate content and publish to a linked Douyin account. Use --skip-publish or a manual review workflow first, inspect the generated article and image, avoid sensitive prompts, and treat logs as potentially sensitive. The publisher should replace shell=True with argument-list execution, narrow triggers to explicit Douyin publishing requests, and add a required publish confirmation or dry-run default.
try:
# 执行命令
result = subprocess.run(
command,
shell=True,
capture_output=True,image_url = data["data"][0]["url"]
# 下载并保存图片
image_data = requests.get(image_url).content
return self.save_generated_image(image_data, prompt)
else:
print(f"DALL-E API错误: {response.status_code}, {response.text}")# 注意：PIL是必需的，其他依赖根据配置而定 # 基础依赖（必需） PIL>=9.0.0 # 可选依赖 requests>=2.31.0
PIL>=9.0.0 # 可选依赖 requests>=2.31.0 # 开发依赖 pytest>=7.0.0
requests>=2.31.0 # 开发依赖 pytest>=7.0.0
63/63 vendors flagged this skill as clean.