Claude Code, Skill
zyun_community
智云AIGC 社区维护的 Agent Skills 合集，面向新媒体运营与内容数据分析场景。部分 skill 需要在 zyunaigc.com 注册获取 ZYUNAIGC_API_KEY。
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV PERMISSION_SHELL_DECLARED SECRETS_ENV_READ
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
shared/scripts/billing.py, line 89
with urllib.request.urlopen(req, timeout=timeout) as resp: - SECRETS_PATH_DOTENV Low
Mentions a .env file.
sync_shared.sh, line 89
# （被 --exclude 的文件同时也不受 --delete 影响，所以 .env 是安全的） - PERMISSION_SHELL_DECLARED Note
Runs shell commands, and the manifest or description says so.
skills/douyin-viral-breakdown/scripts/fetch_content.py, line 226
proc = subprocess.run( - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
shared/scripts/billing.py, line 68
if os.environ.get("ZYUNAIGC_API_KEY"):
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
skills/douyin-viral-breakdown/scripts/fetch_content.py, line 226
proc = subprocess.run(
skills/douyin-viral-breakdown/scripts/fetch_content.py, line 238
proc = subprocess.run(
skills/douyin-viral-breakdown/scripts/local_transcribe.py, line 84
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=1800)
Show more
skills/wechat-channels-viral-breakdown/scripts/fetch_content.py, line 187
proc = subprocess.run(
skills/wechat-channels-viral-breakdown/scripts/fetch_content.py, line 214
proc = subprocess.run(
skills/wechat-channels-viral-breakdown/scripts/fetch_content.py, line 226
proc = subprocess.run(
skills/wechat-channels-viral-breakdown/scripts/local_transcribe.py, line 84
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=1800)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
shared/scripts/billing.py, line 89
with urllib.request.urlopen(req, timeout=timeout) as resp:
skills/account-tracker/scripts/billing.py, line 89
with urllib.request.urlopen(req, timeout=timeout) as resp:
skills/account-tracker/scripts/manage_subscription.py, line 81
with urllib.request.urlopen(req, timeout=timeout) as resp:
Show more
skills/douyin-viral-breakdown/scripts/billing.py, line 89
with urllib.request.urlopen(req, timeout=timeout) as resp:
skills/douyin-viral-breakdown/scripts/fetch_content.py, line 89
with urllib.request.urlopen(req, timeout=timeout) as resp:
skills/douyin-viral-breakdown/scripts/fetch_content.py, line 213
with urllib.request.urlopen(req, timeout=120) as resp, open(dest_path, "wb") as f:
skills/wechat-channels-viral-breakdown/scripts/billing.py, line 89
with urllib.request.urlopen(req, timeout=timeout) as resp:
skills/wechat-channels-viral-breakdown/scripts/decrypt_local.js, line 60
const resp = await fetch(WECHAT_WASM_SCRIPT_URL);
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
sync_shared.sh, line 12
# （会保留目标目录里已有的 .env，那是本地凭证，源里没有）
sync_shared.sh, line 89
# （被 --exclude 的文件同时也不受 --delete 影响，所以 .env 是安全的）
shared/scripts/billing.py, line 68
if os.environ.get("ZYUNAIGC_API_KEY"):
Show more
sync_shared.sh, line 88
# --exclude .env：本地凭证只存在于安装目录，源仓库里不放，同步时不能删掉它
sync_shared.sh, line 92
rsync -a --delete --exclude='.env' --exclude='__pycache__' --exclude='.DS_Store' \
scripts/validate.mjs, line 39
'cache', 'output', '.DS_Store', 'Thumbs.db', '.env', 'venv', '.venv',
scripts/validate.mjs, line 46
(/^\.env/.test(n) && n !== '.env.example')
shared/scripts/billing.py, line 32
API Key 从同目录 scripts/ 下的 .env 读取（`ZYUNAIGC_API_KEY=`），跟同 skill 里其它需要
shared/scripts/billing.py, line 57
"""读取 skill 目录下的 .env（简单 KEY=VALUE，忽略注释和空行）。"""
skills/account-tracker/scripts/billing.py, line 68
if os.environ.get("ZYUNAIGC_API_KEY"):
skills/account-tracker/scripts/manage_subscription.py, line 58
if os.environ.get("ZYUNAIGC_API_KEY"):
skills/douyin-viral-breakdown/scripts/billing.py, line 68
if os.environ.get("ZYUNAIGC_API_KEY"):
skills/douyin-viral-breakdown/scripts/fetch_content.py, line 66
if os.environ.get("ZYUNAIGC_API_KEY"):
skills/wechat-channels-viral-breakdown/scripts/billing.py, line 68
if os.environ.get("ZYUNAIGC_API_KEY"):
skills/wechat-channels-viral-breakdown/scripts/fetch_content.py, line 59
if os.environ.get("ZYUNAIGC_API_KEY"):
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 9412eed47797. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 9412eed47797f2e9d19547aca3864cdcc221cbb1
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.