Security audit
Security checks for vulnerabilities and agentic risk
This is a simple example skill with disclosed dependency and API-key metadata, with no evidence of hidden behavior or malicious actions.
Before installing, read the install commands and only run the sudo package install through your normal trusted admin workflow. Treat this as an example skill and use test or low-privilege API credentials unless you have verified the package source and purpose.
The description field forces a specific language for users reading the skill metadata, and the file does not indicate that the skill is region-specific or that users can choose another language. This is a natural-language policy concern because it may make the skill inaccessible to users who are not expecting Chinese-only descriptions.
The install instructions include sudo apt-get install -y curl jq, which requires elevated privileges and encourages running package-management commands as root during skill setup. While installing common packages is not inherently malicious, embedding privileged commands in a skill increases risk because users may execute them without scrutiny, and any compromise of the install path or surrounding instructions could have system-wide impact.
- description: "安装 Python 依赖"
command: "pip install -r requirements.txt"
- description: "安装系统依赖（Ubuntu/Debian）"
command: "sudo apt-get install -y curl jq"
os: linux
- description: "安装系统依赖（macOS）"
command: "brew install curl jq"