Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly coherent as a skill-building meta-tool, but it bundles default-on telemetry, cloud upload, local profiling, broad local scanning, and publishing workflows that deserve careful review before installation.
Install only if you are comfortable with a meta-skill that can guide agents to scan local skills, maintain usage history, use cloud endpoints, read local creator credentials for proposal approval/publishing, and publish skills through local CLIs. Before using it, disable logging/upload if unwanted, avoid --semantic unless you accept sending skill metadata to an embedding provider, and require explicit confirmation before merge, proposal-apply, or publish actions.
- 对轻量无法判定的"疑似重叠"聚类，调用向量模型对 SKILL.md + references 摘要做 embedding 相似度；
- **无 key 或调用失败 → 静默回退轻量模式**，不阻塞主流程；
- 向量 key 读取顺序（**均不进包**）：
1. env `SILICONFLOW_API_KEY`（若用其他模型，再读 `SILICONFLOW_API_BASE`；硅基流动默认 `https://api.siliconflow.cn/v1/embeddings`）；
2. `~/.workbuddy/secrets/cjg-evo/siliconflow.json`（结构：`{"api_key": "...", "base_url": "..."}` 或仅 `{"api_key": "..."}`）。
> **关于向量 key 的说明**：硅基流动只是"推荐的一个免费向量模型"，**不是唯一选项**。用户可：# ----------------------------------------------------------------------------
def _load_embed_key():
key = os.environ.get("SILICONFLOW_API_KEY")
base = os.environ.get("SILICONFLOW_API_BASE", "https://api.siliconflow.cn/v1/embeddings")
model = os.environ.get("SILICONFLOW_MODEL", "BAAI/bge-m3")
if not key and os.path.isfile(SECRETS_KEY_FILE):
try:env = os.environ.copy()
env["PYTHONIOENCODING"] = "utf-8"
env["PYTHONUTF8"] = "1"
result = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8",
timeout=120, env=env)
if result.returncode == 0:
out = (result.stdout or result.stderr).strip().lstrip("✓ ").lstrip("✗ ")env = os.environ.copy()
env["PYTHONIOENCODING"] = "utf-8"
env["PYTHONUTF8"] = "1"
result = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8",
timeout=120, env=env)
if result.returncode == 0:
print(f" ✓ {(result.stdout or result.stderr).strip()}")65/65 vendors flagged this skill as clean.
No suspicious patterns detected.