Security audit
Security checks across malware telemetry and agentic risk
This skill appears to be a legitimate workflow helper, but it needs Review because it combines broad local code execution with a scope that expands beyond its code-development description.
Install only if you intend to grant a workflow skill permission to run local Python/npm tools, execute configured pipeline scripts, index project knowledge, and write persistent project logs. Review config.json before use, keep pipeline.workspace and paths.pipeline_script pointed at trusted files, avoid using the broad analytics/research modes with sensitive databases, APIs, cookies, or private documents unless you have scoped access deliberately.
"""Run gitnexus analyze --force."""
gitnexus_bin = get_gitnexus_bin()
try:
result = subprocess.run(
[gitnexus_bin, "analyze", "--force"],
cwd=project,
capture_output=True,return True
try:
result = subprocess.run(
["python3", "pipeline.py", "new", project_name],
cwd=pipeline_workspace,
capture_output=True,log_progress(0, total_stages, "执行 REQ 阶段...")
last_shown_stage = 0
result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
elapsed = time.time() - start_time
if result.returncode == 0:log_step(1, "REQ - 需求分析", "running")
log_progress(0, total_stages, "开始执行 Pipeline...")
result = subprocess.run(cmd, capture_output=True, text=True, timeout=1800) # 30 分钟超时
elapsed = time.time() - start_time
if result.returncode == 0:return True # No summary to log
try:
result = subprocess.run(
["python3", str(auto_log_script), str(pipeline_summary)],
capture_output=True, text=True, timeout=60
)# Check freshness via gitnexus status
gitnexus_bin = get_gitnexus_bin()
try:
proc = subprocess.run(
[gitnexus_bin, "status"],
cwd=project,
capture_output=True,# Try to get phase from pipeline status
try:
proc = subprocess.run(
["python3", "pipeline.py", "status", project_name],
cwd=pipeline_workspace,
capture_output=True,67/67 vendors flagged this skill as clean.
No suspicious patterns detected.