Security audit
Security checks across malware telemetry and agentic risk
The thesis-writing workflow mostly matches its stated purpose, but it contains an unsafe parser that can run code from an AI response and several under-scoped local file/config behaviors.
Review carefully before installing. Do not run this skill in a trusted workspace until reviewer.py replaces eval() with strict JSON parsing, config.env gets safer handling, and destructive/auto-advance paths are gated. If testing is necessary, use a disposable workspace with no secrets and inspect any package installation or generated files first.
# 尝试提取 JSON（可能在 markdown 代码块中）
json_match = re.search(r'\{[\s\S]*\}', response)
if json_match:
result = eval(json_match.group()) # 安全的简单解析
else:
result = eval(response) # 直接解析
except Exception:if json_match:
result = eval(json_match.group()) # 安全的简单解析
else:
result = eval(response) # 直接解析
except Exception:
return {
"ok": False,try:
json_match = re.search(r'\{[\s\S]*\}', response)
if json_match:
result = eval(json_match.group())
else:
result = eval(response)
return {"ok": True, **result}if json_match:
result = eval(json_match.group())
else:
result = eval(response)
return {"ok": True, **result}
except Exception as e:
return {if json_match:
result = eval(json_match.group()) # 安全的简单解析
else:
result = eval(response) # 直接解析
except Exception:
return {
"ok": False,if json_match:
result = eval(json_match.group())
else:
result = eval(response)
return {"ok": True, **result}
except Exception as e:
return {read -p "作者姓名: " AUTHOR_NAME
# 写入 config.env
cat > "$SKILL_DIR/config.env" << EOF
# MBA Thesis Workflow 配置（自动生成）
WORKSPACE_ROOT=$WORKSPACE_ROOTread -p "作者姓名: " AUTHOR_NAME
# 写入 config.env
cat > "$SKILL_DIR/config.env" << EOF
# MBA Thesis Workflow 配置（自动生成）
WORKSPACE_ROOT=$WORKSPACE_ROOT
USER_EMAIL=$USER_EMAIL63/63 vendors flagged this skill as clean.