内容蒸馏器

• Outcome: Review
• Latest audit: Jun 22, 2026 · 6:11 AM UTC
• Version: 1.0.1

Overview

This skill mostly does what it says, but it can silently install Python packages and create persistent skill files in the user's WorkBuddy skills directory.

Install only if you are comfortable with a skill that can create new local skills and may fetch external discussion content. Before using it on PDFs or EPUBs, check or remove the scripts' automatic pip installation behavior, and review generated skill directories before letting them persist in your WorkBuddy skills folder.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        import subprocess
        python = str(Path.home() / ".workbuddy/binaries/python/envs/default/bin/python3")
        subprocess.run([python, "-m", "pip", "install", "ebooklib", "beautifulsoup4", "-q"], check=True)
        from ebooklib import epub
        from bs4 import BeautifulSoup

• Confidence: 93% confidence
• Finding: The script automatically invokes pip through a subprocess when imports fail, causing code from external packages to be fetched and installed at runtime without explicit user approval. This expands the script's behavior beyond EPUB extraction, introduces supply-chain and environment-tampering risk, and may execute package installation logic in the user's environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        import subprocess, pathlib
        python = str(pathlib.Path.home() / ".workbuddy/binaries/python/envs/default/bin/python3")
        subprocess.run([python, "-m", "pip", "install", "pdfplumber", "-q"], check=True)
        import pdfplumber

    if not os.path.exists(input_path):

• Confidence: 89% confidence
• Finding: The script invokes pip in a subprocess to install a dependency at runtime, which causes code from an external package index to be fetched and executed during normal document processing. This expands the attack surface, bypasses normal dependency management controls, and can lead to unreviewed code execution or environment tampering if the package source, resolver, or local interpreter path is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The instruction to proactively search third-party comment sections and discussions expands the skill from transforming user-provided content into autonomous network reconnaissance on external services. That broadening can expose user interests to third parties, collect unnecessary external data, and cause the agent to traverse untrusted content far beyond the original task scope.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Auto-installing packages is not necessary for the stated purpose of extracting text from an EPUB and gives the script network/package-management capabilities that increase attack surface. In a skill that processes user-supplied content, silently modifying the runtime environment is especially risky because it can introduce unreviewed code and non-deterministic behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Installing packages on demand is not necessary for basic PDF text extraction and introduces a hidden side effect unrelated to the user's expectation of reading a local PDF. Because pip installation executes package build/install logic and modifies the runtime environment, it can be abused for supply-chain compromise or persistence in contexts where this skill processes untrusted content.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger list contains broad natural-language phrases such as '蒸馏' and similar everyday expressions, increasing the chance the skill activates in conversations where the user did not intend file creation, shell execution, or content fetching. Overbroad activation is more dangerous here because the skill also performs persistent writes and external retrieval, so accidental invocation can lead to unintended side effects.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that generated skills will be installed automatically into `~/.workbuddy/skills/` and may also be packaged, but it does not require an explicit user-facing warning or approval before modifying the local filesystem. Silent or implicit persistence in a home-directory path is risky because it can clutter the environment, overwrite existing content, or plant future-executable artifacts under the guise of content processing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions direct the agent to fetch external content and search comment/discussion areas without a clear warning that network activity will occur or that third parties may learn about the requested URLs/topics. This is dangerous because it can leak user interests, process untrusted remote content, and exceed what the user expected from a local distillation workflow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script performs package installation without any warning or confirmation, so a user invoking a simple text-extraction utility may unknowingly trigger environment changes and dependency downloads. This is dangerous because it hides privileged side effects and prevents users from making an informed trust decision about external code execution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code silently installs software without warning or confirmation, which violates least surprise and removes an important trust boundary for users and operators. Even if the package is legitimate, automatic installation can alter the host environment, introduce inconsistent behavior, and create a path for unintended code execution from external repositories.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.