Security audit
Security checks across malware telemetry and agentic risk
This office automation skill is mostly coherent, but it under-discloses cloud data transfer and exposes powerful local document/app-control actions.
Review this skill before installing in sensitive environments. Use explicit local-only options where available, avoid cloud ASR/LLM modes for confidential meetings, review backups created under WPS_Backup, and be careful with COM cleanup or release-all commands because they may close or kill Office/WPS processes.
if self.is_windows:
for proc in self.WPS_PROCESSES:
try:
subprocess.run(
["taskkill", "/F", "/IM", proc],
capture_output=True, timeout=5
)for proc in self.MS_PROCESSES:
try:
subprocess.run(
["taskkill", "/F", "/IM", proc],
capture_output=True, timeout=5
)# SkillHub 反馈页面（假设的 URL，实际需替换）
url = "https://skillhub.cn/feedback"
if platform.system() == "Windows":
subprocess.Popen(["start", url], shell=True)
elif platform.system() == "Darwin":
subprocess.Popen(["open", url])
else:mailto = f"mailto:{email}?subject={subject}&body={body}"
if platform.system() == "Windows":
subprocess.Popen(["start", mailto], shell=True)
elif platform.system() == "Darwin":
subprocess.Popen(["open", mailto])
else:)
try:
with urllib.request.urlopen(req, timeout=30) as resp:
result = json.loads(resp.read().decode("utf-8"))
content = result["choices"][0]["message"]["content"]
return {"summary": {"raw": content}, "structured": False}VirusTotal findings are pending for this skill version.
No suspicious patterns detected.