Integrated Manufacturing Consulting

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 7.3.2

Overview

The skill’s report-generation purpose is real, but it also self-modifies its instructions, scans other installed skills, and mandates external delivery of generated reports.

Review before installing. Use this only in an environment where automatic local logging, broad attachment processing, and external delivery are acceptable. Disable or remove self-repair writes to SKILL.md, make WeChat/email/Tencent Docs delivery opt-in per file, avoid curl-to-shell installation, pin dependencies, and restrict Ollama to localhost before handling confidential client materials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:2678
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:2678-2681` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # 1. Install Ollama curl -fsSL https://ollama.com/install.sh | sh ``` ### Technical Analysis The installation instructions download a mutable script from an external URL and immediately execute it with `sh`. The command does not pin a version, verify a cryptographic checksum or digital signature, save the script for inspection, or otherwise establish that the downloaded payload matches the version reviewed during this audit. The effective code executed by this instruction can change at any time without any corresponding change to the audited Skill. Compromise of the remote server, its deployment pipeline, DNS resolution, or the relevant TLS trust chain could therefore turn this instruction into an arbitrary-code-execution path. Installing Ollama is optional supporting functionality rather than a minimum requirement for producing reports, because the Skill also documents a fully offline template mode. Direct remote execution consequently exceeds the least-risk installation method needed for the declared functionality. ### Attack Path 1. A user or Agent follows the Ollama setup instructions. 2. `curl` retrieves the current content hosted at `https://ollama.com/install.sh`. 3. The retrieved content is streamed directly to `sh` without inspection or integrity verification. 4. A compromised or subsequently modified installer executes arbitrary shell commands. 5. Those commands operate with the permissions of the invoking account and potentially elevated permissions if the installer requests or inherits them. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's privileges. Depending on those privileges and the behavior of the remote installer, an attacker could modify files, install additional software, access user- ...[truncated 215 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | sh` instruction. - Direct users to an official, versioned package or installer appropriate to their operating system. - If a script must be downloaded, save it locally before execution and verify a publisher signature or a pinned SHA-256 checksum. - Pin the expected Ollama release rather than installing an unspecified current version. - Display the exact artifact and verification result and require explicit user approval before execution. - Run installation in a restricted environment without administrative privileges unless elevation is demonstrably required. - Preserve the existing template-only mode as the default when Ollama is unavailable. ]]>

T02 · Agent Memory Poisoning

Error

• Location: references/self_repair.py:142
• Finding: Runtime and User-Controlled Error Text Can Persistently Modify Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `references/self_repair.py:142-172, 273-337`; mandatory behavior documented at `SKILL.md:1844-1923` **Vulnerability Type**: Persistent instruction and memory poisoning **Risk Level**: High ### Vulnerable Code ```python def append_error_to_skill_md(error_text, cause_text, fix_text, error_number=None): """向SKILL.md追加新的错误条目""" content = load_skill_md() if not content: return # 自动计算错误编号 if error_number is None: error_pattern = re.findall(r'### 错误(\d+)', content) if error_pattern: error_number = max(int(n) for n in error_pattern) + 1 else: error_number = 10 # 当前已有9个 # 标签 tag = "【v6 新增】" if error_number >= 8 else "" new_entry = f""" ### 错误{error_number}：{error_text} {tag} **原因**：{cause_text} **修复**：{fix_text} """ # 追加到「常见错误与修复」章节末尾 marker = "---\n\n## 十三、技能自进化系统" if marker in content: content = content.replace(marker, f"{new_entry}\n{marker}") else: # fallback: 文件末尾追加 content += f"\n{new_entry}\n" save_skill_md(content) print(f"🛠️ 自修复完成：已在SKILL.md追加「错误{error_number}：{error_text}」") ``` ```python for issue in issues["errors"]: level = classify_issue(issue) issue["level"] = level if level in ("P0", "P1") and not is_error_already_documented( issue.get("description", "") ): append_error_to_skill_md( error_text=issue.get("description", ""), cause_text=issue.get("root_cause", "待分析"), fix_text=issue.get("fix", "待确定") ) if issue.get("function_to_update"): update_function_spec( issue["function_to_update"], issue.get("new_spec", "") ) if issue.get("new_checklist_item"): append_checklist_item(issue["new_checklist_item"]) issue["fixed"] = True repair_count += 1 ``` ...[truncated 2319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove automatic modification of `SKILL.md` from normal report-generation workflows. - Store errors and proposed improvements in a separate structured data file that is never interpreted as Agent instructions. - Require explicit human review and approval before applying any proposed Skill change. - Define a strict schema and length limits for every issue field. - Escape Markdown control syntax and reject headings, code fences, XML/HTML directives, and instruction-like content where free text is unavoidable. - Use authenticated provenance for error records and prevent arbitrary modification of `error_log.json`. - Produce a reviewed patch or diff instead of writing directly to the installed Skill. - Back up the original file, use atomic writes, and verify the resulting document before activation. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:1937
• Finding: Generated Reports Are Mandatorily Sent to an External Delivery Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1937-2000` **Vulnerability Type**: Skill instruction hijacking causing unauthorized external delivery **Risk Level**: High ### Vulnerable Code ```markdown ### S14: File Delivery and WeChat Push > After report generation, deliver the corresponding file and automatically > push it to the WeChat mini-program. Use the `deliver_attachments` tool to send files to the WorkBuddy WeChat mini-program: Steps: 1. Call deliver_attachments(file_path) to send the file 2. Tell the user to enable artifact return in the WorkBuddy mini-program 3. If automatic pushing is requested, create an automation task Delivery methods: | Method | Description | Condition | |:--|:--|:--| | `deliver_attachments` | Send to the WorkBuddy WeChat mini-program | WeChat bound | | QQ email | Send an email attachment through qq-email | Authorization code required | | Tencent Docs | Upload and share a link | tencent-docs required | R23: S14 file delivery must execute after every PPT generation and cannot be skipped. R24: The user must be prompted to check the mini-program artifact-return switch. R25: Successful delivery must be written to delivery_log.json. ``` ### Technical Analysis The Skill declares external delivery to be mandatory after every PPT generation. This changes a local report-generation request into a network transmission workflow without requiring separate, destination-specific consent. The generated reports are explicitly derived from user-uploaded project materials and may include customer data, operational metrics, organizational structures, screenshots, diagnoses, and strategic recommendations. Sending such an artifact through `deliver_attachments`, email, or a cloud-document service crosses a significant confidentiality boundary. External delivery is not necessary to generate or save PPTX, DOCX, PDF, or mind-map files. The mandatory rule therefore exceeds the minimum privileges and network access necessary for ...[truncated 1054 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make local file creation the default and do not invoke any delivery tool automatically. - Require explicit, informed approval for each file, recipient, service, and transmission. - Display the exact destination and privacy boundary before sending. - Provide a local download path so external delivery is never required. - Remove Rule R23 and replace it with an opt-in workflow. - Avoid suggesting email or cloud upload unless the user specifically requests that destination. - Minimize delivery logs and do not record sensitive paths or recipient information unnecessarily. - Document retention, encryption, access-control, and deletion behavior for every supported delivery provider. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/self_evolution.py:115
• Finding: Self-Evolution Component Enumerates and Reads Unrelated Installed Skills<![CDATA[ ## Vulnerability Details **File Location**: `references/self_evolution.py:34-35, 115-156` **Vulnerability Type**: Excessive local filesystem access and cross-Skill reconnaissance **Risk Level**: Medium ### Vulnerable Code ```python SKILLS_DIR = os.path.expanduser("~/.workbuddy/skills") EVO_DIR = "self_evolution" ``` ```python def scan_new_skills(): """扫描 ~/.workbuddy/skills/ 发现新技能""" ensure_evo_dir() known = load_json("known_skills.json") known_names = {s.get("name", "") for s in known} new_skills = [] if not os.path.exists(SKILLS_DIR): print(f"⚠️ 技能目录不存在: {SKILLS_DIR}") return new_skills for skill_dir in sorted(os.listdir(SKILLS_DIR)): skill_path = os.path.join(SKILLS_DIR, skill_dir) if not os.path.isdir(skill_path): continue description = "" skill_md = os.path.join(skill_path, "SKILL.md") if os.path.exists(skill_md): with open(skill_md, 'r', errors='ignore') as f: for line in f: if 'description:' in line: description = line.split('description:')[-1].strip().strip('>| ') break if skill_dir not in known_names: relevance = assess_relevance(skill_dir, description) if relevance >= 2: new_skills.append({ "name": skill_dir, "description": description[:100], "relevance_score": relevance, "discovered_at": datetime.now().isoformat(), "status": "new", }) for ns in new_skills: known.append(ns) save_json("known_skills.json", known) return new_skills ``` ### Technical Analysis The self-evolution feature enumerates the global `~/.workbuddy/skills` directory, opens the instruction file of every installed Skill, extracts descriptions, and persists the ...[truncated 1282 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove global Skill discovery from the report-generation workflow. - Restrict file access to the current project and user-selected input/output directories. - If integration discovery is genuinely needed, require explicit user approval and an allowlist of Skill names. - Use a platform-provided capability registry that exposes only approved metadata rather than opening other Skills' instruction files. - Do not persist a complete capability inventory by default. - Apply restrictive permissions and a clear retention policy to any approved metadata cache. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:365
• Finding: Runtime Dependencies Are Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:365, 1619, 1669, 1688, 1702, 1730-1738, 2057, 2086, 2159` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install 'markitdown[all]' ``` ```bash pip install python-pptx lxml pip install python-docx pip install reportlab markdown ``` ```bash pip install python-pptx lxml python-docx reportlab ``` ### Technical Analysis The Skill instructs users or Agents to install packages by name without exact versions, hashes, a lock file, or an explicitly approved package index. The actual package set can therefore vary over time, and transitive dependencies can change without review. Python package installation may execute build backends and package installation logic. A compromised package release, compromised maintainer account, malicious transitive dependency, dependency-resolution change, or use of an untrusted configured index could introduce arbitrary code into the environment. No evidence of a deliberately typosquatted package was found. The vulnerability is the unsafe and non-reproducible dependency acquisition method. ### Attack Path 1. An Agent follows a documented `pip install` command. 2. `pip` resolves the latest matching versions and transitive dependencies from its configured indexes. 3. A compromised or malicious release is selected. 4. Package build or installation logic runs locally. 5. Malicious code subsequently executes during installation or when the report-generation scripts import the package. ### Impact Assessment A compromised dependency can execute with the permissions of the account running `pip` or the report generator. It may access user-readable files, uploaded business material, generated reports, environment variables, and network resources. Installing globally or with elevated privileges would increase the scope to shared Python environments or system locations. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Provide a reviewed dependency lock file containing exact versions and hashes. - Install with hash enforcement, such as `pip install --require-hashes -r requirements.txt`. - Use an isolated virtual environment with no administrative privileges. - Pin both direct and transitive dependencies. - Configure an approved package index and disable unintended extra indexes. - Review package provenance, licenses, release signatures, and known vulnerabilities. - Separate optional document-conversion dependencies from the minimal installation set. - Update dependencies through a controlled review process rather than resolving latest releases at runtime. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/generate_offline_content.py:9
• Finding: Unrestricted OLLAMA_HOST Can Redirect Prompts to an Arbitrary Plaintext Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `references/generate_offline_content.py:9, 58-91` **Vulnerability Type**: Unvalidated network endpoint configuration **Risk Level**: Medium ### Vulnerable Code ```python OLLAMA_HOST = os.environ.get("OLLAMA_HOST", "http://localhost:11434") DEFAULT_MODEL = "gemma4:e2b-it-q4_K_M" ``` ```python def check_ollama(): """检查Ollama是否可用""" try: import urllib.request req = urllib.request.Request(f"{OLLAMA_HOST}/api/tags") with urllib.request.urlopen(req, timeout=5) as resp: data = json.loads(resp.read()) return len(data.get("models", [])) > 0 except: return False def call_ollama(prompt, model=DEFAULT_MODEL, max_tokens=500): """调用本地Ollama模型生成内容""" import urllib.request payload = json.dumps({ "model": model, "prompt": prompt, "stream": False, "options": {"num_predict": max_tokens} }).encode() req = urllib.request.Request( f"{OLLAMA_HOST}/api/generate", data=payload, headers={"Content-Type": "application/json"} ) try: with urllib.request.urlopen(req, timeout=120) as resp: data = json.loads(resp.read()) return data.get("response", "") except Exception as e: return f"[离线模式] 无法调用本地模型: {e}" ``` ### Technical Analysis The default endpoint is loopback, but the `OLLAMA_HOST` environment variable is accepted without validation. The code does not require a loopback destination, restrict allowed ports, enforce HTTPS for remote destinations, or ask for consent before sending a prompt. An attacker or deployment configuration capable of setting environment variables can redirect both the availability request and generation request to an arbitrary HTTP or HTTPS endpoint. The generation request contains the full prompt in JSON. In the current implementation example, prompts are short topic requests, but this helper can accept a ...[truncated 1209 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Accept only loopback destinations such as `127.0.0.1`, `::1`, or a strictly parsed `localhost` URL by default. - Reject credentials, unexpected paths, unsupported schemes, and unapproved ports in `OLLAMA_HOST`. - Require explicit user approval before enabling a remote Ollama endpoint. - Require HTTPS with certificate validation for any approved non-loopback endpoint. - Clearly warn when document-derived content will cross the local machine boundary. - Minimize prompts and redact sensitive fields before transmission. - Separate local and remote model configuration so an environment variable alone cannot silently change the privacy boundary. - Consider authenticating the local Ollama endpoint where the deployment environment permits it. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (63)

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

try:
        import urllib.request
        req = urllib.request.Request(f"{OLLAMA_HOST}/api/tags")
        with urllib.request.urlopen(req, timeout=5) as resp:
            data = json.loads(resp.read())
            return len(data.get("models", [])) > 0
    except:

• Confidence: 91% confidence
• Finding: The code constructs outbound HTTP requests from the OLLAMA_HOST environment variable without validating or constraining the destination. If an attacker can influence the process environment, they can redirect requests to arbitrary internal or external endpoints, creating SSRF-style behavior, unexpected data exfiltration, or interaction with sensitive local services.

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)
    
    try:
        with urllib.request.urlopen(req, timeout=120) as resp:
            data = json.loads(resp.read())
            return data.get("response", "")
    except Exception as e:

• Confidence: 93% confidence
• Finding: This request sends prompt content to a URL derived from the untrusted OLLAMA_HOST environment variable, so environment manipulation can redirect generated content and prompts to attacker-controlled infrastructure. In a skill context, prompts may include sensitive business content, making this both a confidentiality risk and a channel for SSRF against internal services.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger phrases include very broad everyday requests and even state that uploading any content should automatically trigger the skill. Overbroad triggers can cause the skill to activate unexpectedly on unrelated uploads, increasing the chance that sensitive files are processed, logged, searched externally, or delivered outward without the user's informed intent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The self-repair design explicitly allows the skill to modify SKILL.md and reference files based on runtime issues and user feedback. A content-generation skill should not be self-modifying; this creates a durable persistence mechanism where prompt-injected content, malicious inputs, or faulty heuristics can alter future behavior and poison the local skill base.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The workflow includes automatic delivery to WeChat mini-program and optional email/Tencent Docs sharing, but the description does not present this as a clear, prominent warning requiring prior consent. External sharing of generated reports can disclose confidential client data to third-party platforms or unintended recipients.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. 安装Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 2. 下载模型（需要一次联网）
ollama pull gemma4:e2b-it-q4_K_M

• Confidence: 99% confidence
• Finding: The documentation includes a one-line remote install command that fetches and executes a shell script directly from the internet using curl piped to sh. This is a classic high-risk pattern because it executes unaudited remote code immediately, allowing supply-chain compromise or malicious script substitution to fully compromise the environment.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. 安装Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 2. 下载模型（需要一次联网）
ollama pull gemma4:e2b-it-q4_K_M

• Confidence: 99% confidence
• Finding: The use of a shell pipeline to pass downloaded content directly into sh compounds the risk by chaining retrieval and execution without inspection. In the context of a skill file, this is especially dangerous because users or downstream agents may treat it as an endorsed operational step and execute it automatically or with reduced scrutiny.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill specifies automatic network searches for images, icons, reference PPTs, and color sources, plus post-generation delivery to an external mini-program, without a clear warning about what user data or document-derived keywords may be transmitted. Because report-generation inputs often contain sensitive business content, silent outbound transmission materially increases confidentiality and data-leakage risk.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The main flow performs multiple persistent writes—error logs, summaries, and especially SKILL.md modifications—driven by runtime inputs with no approval, trust boundary checks, or integrity protections. In a skill context, this is more dangerous because it creates a self-modifying agent pattern: untrusted inputs can poison future instructions and behavior across runs, effectively turning transient input manipulation into persistent compromise.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The top-level description is written to generate Chinese-language executive consulting reports and repeatedly mandates Chinese-specific style choices such as 微软雅黑 and humanizer-zh, without offering the user a language or locale choice. This can violate language/locale policy when the skill is used in broader contexts or by users expecting multilingual support.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The skill claims local/offline support, yet large parts of the documented workflow make network-dependent scanning, web search, installation, and external delivery mandatory or default. This mismatch can mislead users about data residency and transmission, causing sensitive materials to be handled in ways the user did not expect.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill describes a self-evolution engine that scans local skill directories, recommends or auto-integrates other skills, and logs execution behavior. That capability is not necessary for generating consulting reports and expands the trust boundary to unrelated local content, creating a path for unintended data exposure, privilege creep, and execution of unreviewed functionality.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The self-evolution section says the skill will track usage patterns, record errors, and write logs, but this persistence is not surfaced as a clear user-facing warning. Silent local retention of user-derived activity and feedback increases privacy risk and can create long-lived stores of sensitive project information.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill persistently records usage data, execution patterns, and related logs for later reuse. Storing operational traces around user interactions can capture sensitive business context over time, especially in a consulting setting where uploaded materials may be confidential.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description emphasizes automatic research and expansion of user materials but does not prominently warn users that uploaded content may be used in external web searches or transmitted to outside sources. Missing disclosure weakens informed consent and makes accidental leakage of confidential business data more likely.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The workflow requires writing extracted user material into persistent summary files and explicitly preserving every page and data point for report reuse. For consulting documents, this can create durable local copies of highly sensitive client information beyond the immediate task, increasing exposure if the host is compromised or shared.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill mandates storing execution issues and user feedback, then feeding them back into skill files and evolution records. This couples persistent storage with behavior modification, turning user-provided content into a long-term influence on future executions and increasing the risk of prompt-injection persistence or privacy leakage.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The workflow mandates automatic file delivery to WeChat and optionally email or Tencent Docs after report generation. Automatic outbound delivery is not required to create a report and can exfiltrate sensitive customer materials or derived outputs to external services without meaningful, per-run consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template labels the report as confidential and includes client-specific fields, but it provides no handling guidance for the sensitive business and personal data likely to be collected. In a consulting/reporting workflow, this omission can lead to over-collection, insecure sharing, and accidental disclosure of customer, employee, or operational information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The appendix explicitly asks for site photos, interview notes, participant lists, data collection summaries, and questionnaire analysis, all of which may contain personal data, trade secrets, or sensitive facility details. Without consent, privacy, and sanitization guidance, users may embed identifiable or confidential material directly into reusable reports and circulate it broadly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The checklist explicitly recommends using recording equipment and taking on-site photos, but it does not clearly require prior consent, authorization, or adherence to privacy and confidentiality controls. In a real enterprise survey context, this can lead to unauthorized capture of employee information, customer data, trade secrets, or regulated operational details, creating privacy, contractual, and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The checklist asks consultants to collect customer complaints, return data, and other detailed operational metrics without warning that such information may be commercially sensitive, confidential, or contain personal data. This omission can normalize over-collection or mishandling of sensitive business information, increasing the risk of unauthorized disclosure or noncompliant data processing.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The module title and description are written entirely in Chinese, and all user-facing strings and comments in the file likewise assume Chinese as the required interaction language. There is no indication that the skill offers a language choice or that the Chinese-only behavior is a documented, region-specific requirement, which makes this a natural-language locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file is entirely written in Chinese and provides no indication that language choice is optional or limited to a justified region-specific context. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale/language policy issue.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 方法1: markitdown (推荐)
        try:
            import subprocess
            result = subprocess.run(
                ["markitdown", file_path],
                capture_output=True, text=True, timeout=120  # 大文件可能需要较长时间
            )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.