The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/getzdday.py executes subprocess.run("chcp 65001", shell=True) when running on Windows. This is a standard operation used to set the active code page to UTF-8 for proper character display and does not pose a security risk in this context.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of python-dotenv and tzdata via pip. These are standard, reputable libraries used for managing environment variables and timezone information.
[DATA_EXFILTRATION]: The script scripts/getzdday.py sends user-configured API credentials (JKHZ_ID and JKHZ_KEY) to the external domain cn.apihz.cn. This is the documented and intended behavior for interacting with the 接口盒子 API, but it involves sending sensitive keys to a third-party service.
[SAFE]: The skill ingests untrusted data from an external API (apihz.cn) and displays it to the user.
Ingestion points: API response data processed in scripts/getzdday.py.
Boundary markers: Absent.
Capability inventory: Subprocess execution for encoding and network requests for API interaction in scripts/getzdday.py.
Sanitization: Performs minor character replacement for formatting (| to ｜) but does not sanitize for potential instructions or markdown injection.
[SAFE]: The skill follows security best practices by recommending that API credentials be stored in .env files outside of the skill's source code.

calendar-api