wechat-prohibited-word

SUSPICIOUS. 敏感词检测本身与所需文件/网络能力基本匹配，调用 redfox.hk 官方接口也与宣称用途一致；但技能把“积分不足自动充值”内置为默认流程，要求安装并运行未固定版本的外部支付 CLI，扩大了与核心检测任务不成比例的信任边界。再加上会扫描 shell 配置文件读取 API Key、自动监听支付并重跑请求，整体属于高风险供应链与凭证处理设计，而非明显恶意窃取。

The code extracts user-selected text and submits it with REDFOX_API_KEY to the hard-coded redfox[.]hk API, which is consistent with its stated purpose but transmits potentially sensitive content and credentials to that service. User-supplied URLs are fetched without destination validation, presenting an SSRF risk to local or internal services. An insufficient-credit response triggers instructions to use an alipay-bot payment workflow and prints API-provided cashier and order details, but the script does not itself execute payment commands. Overall severity is moderate, primarily due to unrestricted URL fetching and credential/content transmission.