Exec Reducer

Provides reusable tools to batch process files for reading, writing, and searching, reducing exec command usage.

Security Scan

The skill's code broadly matches its stated purpose (batch file read/write/search) but the runtime instructions (SKILL.md) are inconsistent with the shipped script and the script exposes unconstrained filesystem I/O that could be misused or behave unexpectedly.

Purpose & Capability

The skill claims to reduce exec usage for batch file operations and the Python script implements read, write, append, list, and search operations — this is coherent with the name/description. However the SKILL.md examples reference a different filename (exec-batch-skill.py) and present a simplified 'search <query>' API that does not match the script signature (script requires <path> <pattern>). The mismatch between documentation and code is a red flag for sloppy packaging or misconfiguration.

Instruction Scope

SKILL.md instructs running a Python helper to read/write/search files which is within the stated purpose, but the docs are inaccurate (wrong script name and wrong search args). The script itself performs unconstrained filesystem I/O (reading arbitrary files, writing/appending, listing directories, recursive glob search). That capability is expected for a file-processing tool, but because the instructions are wrong and the script accepts arbitrary paths/contents (and does not sanitize or join argv content), an agent or user could accidentally read or overwrite sensitive files if invoked with broad access. The script also takes the content argument as a single argv token, so multi-word content will be truncated unless callers join args — another usability/behavior mismatch.

Install Mechanism

No install spec — instruction-only with a single Python script. Nothing is written to disk by an installer beyond the provided file in the skill bundle.

Credentials

The skill requires no environment variables or external credentials. The filesystem access it requests is aligned with its stated purpose, but still powerful: read/write/list/search operate on arbitrary paths without restrictions.

Persistence & Privilege

always is false and the skill does not request persistent or cross-skill configuration. Autonomous invocation (disable-model-invocation false) is the platform default; this combined with unrestricted file I/O increases blast radius but is not itself a packaging inconsistency.

What to consider before installing

The script does what the description says (file read/write/search) but the documentation is wrong and the script allows unconstrained filesystem I/O. Before installing: (1) correct the SKILL.md to match the actual filename and arguments; (2) review the Python file yourself — it will read and overwrite any path the agent can access; (3) do not run the agent with elevated privileges or broad filesystem access if you enable this skill; (4) consider adding path whitelisting, input validation, and proper argument handling (join multi-token content) to avoid accidental data loss or exfiltration; (5) if you lack the ability to audit the code, treat this skill as higher risk and avoid enabling autonomous invocation or limit it to a sandboxed user.

exec-batch-skill

功能

封装常用操作为可复用工具，减少exec调用

触发条件

当需要批量处理文件、搜索、写入时使用

使用方法

# 读取文件
python exec-batch-skill.py read <filepath>

# 写入文件  
python exec-batch-skill.py write <filepath> <content>

# 搜索
python exec-batch-skill.py search <query>