Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its academic assistant purpose, but it needs review because optional PDF/LLM processing can send document text and an API key to an unexplained plaintext endpoint.
Install only if you are comfortable reviewing the scripts first. Before using PDF extraction with LLM support, set an explicit trusted HTTPS or loopback BASE_URL, use a limited API key, and do not process identifiable patient or confidential documents. Avoid the curl-to-bash installer path unless you independently verify the installer.
TOOLS.md:265Unverified Remote Installer Is Piped Directly into Bash
scripts/extract_knowledge_cards.py:883PDF Content and API Credentials Can Be Sent to a Hard-Coded Plaintext Endpoint
requirements.txt:2Python Dependencies Are Not Pinned to Reviewed Versions or Integrity Hashes
A skill described as end-user academic assistance but actually focused on testing, schema validation, and extraction-pipeline QA creates a misleading trust model. While not inherently malicious, this discrepancy can hide non-obvious access to local data, pipeline internals, and maintenance functions that should undergo stricter review than a passive content assistant.
A skill described as end-user academic assistance but actually focused on testing, schema validation, and extraction-pipeline QA creates a misleading trust model. While not inherently malicious, this discrepancy can hide non-obvious access to local data, pipeline internals, and maintenance functions that should undergo stricter review than a passive content assistant.
A skill described as end-user academic assistance but actually focused on testing, schema validation, and extraction-pipeline QA creates a misleading trust model. While not inherently malicious, this discrepancy can hide non-obvious access to local data, pipeline internals, and maintenance functions that should undergo stricter review than a passive content assistant.
A skill described as end-user academic assistance but actually focused on testing, schema validation, and extraction-pipeline QA creates a misleading trust model. While not inherently malicious, this discrepancy can hide non-obvious access to local data, pipeline internals, and maintenance functions that should undergo stricter review than a passive content assistant.
A skill described as end-user academic assistance but actually focused on testing, schema validation, and extraction-pipeline QA creates a misleading trust model. While not inherently malicious, this discrepancy can hide non-obvious access to local data, pipeline internals, and maintenance functions that should undergo stricter review than a passive content assistant.
A skill described as end-user academic assistance but actually focused on testing, schema validation, and extraction-pipeline QA creates a misleading trust model. While not inherently malicious, this discrepancy can hide non-obvious access to local data, pipeline internals, and maintenance functions that should undergo stricter review than a passive content assistant.
A skill described as end-user academic assistance but actually focused on testing, schema validation, and extraction-pipeline QA creates a misleading trust model. While not inherently malicious, this discrepancy can hide non-obvious access to local data, pipeline internals, and maintenance functions that should undergo stricter review than a passive content assistant.
The documentation recommends curl ... | bash, which executes remotely fetched script content directly without inspection, signature verification, or checksum validation. If the remote server, CDN, DNS, TLS termination, or distribution channel is compromised, users can execute arbitrary code on their machine immediately.
# 1. 安装 CLI
curl -fsSL https://skillhub.cn/install/install.sh | bash -s -- --no-skills
# 2. 登录
skillhub login --key "$SKILLHUB_KEY" --host https://api.skillhub.cn
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
This keeps all CLI scripts aligned on:
- project-relative default paths
- WANGQI_ENV_FILE override
- workspace-root .env fallback during local development
"""
import os
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
This keeps all CLI scripts aligned on:
- project-relative default paths
- WANGQI_ENV_FILE override
- workspace-root .env fallback during local development
"""
import os
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
This keeps all CLI scripts aligned on:
- project-relative default paths
- WANGQI_ENV_FILE override
- workspace-root .env fallback during local development
"""
import os
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
This keeps all CLI scripts aligned on:
- project-relative default paths
- WANGQI_ENV_FILE override
- workspace-root .env fallback during local development
"""
import os
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
This keeps all CLI scripts aligned on:
- project-relative default paths
- WANGQI_ENV_FILE override
- workspace-root .env fallback during local development
"""
import os
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
This keeps all CLI scripts aligned on:
- project-relative default paths
- WANGQI_ENV_FILE override
- workspace-root .env fallback during local development
"""
import os
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
This keeps all CLI scripts aligned on:
- project-relative default paths
- WANGQI_ENV_FILE override
- workspace-root .env fallback during local development
"""
import os
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
This keeps all CLI scripts aligned on:
- project-relative default paths
- WANGQI_ENV_FILE override
- workspace-root .env fallback during local development
"""
import os
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if explicit_path.exists():
return explicit_path.resolve(), "WANGQI_ENV_FILE", None
workspace_env = WORKSPACE_DIR / ".env"
if workspace_env.exists():
warning = None
if explicit_path is not None:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if explicit_path.exists():
return explicit_path.resolve(), "WANGQI_ENV_FILE", None
workspace_env = WORKSPACE_DIR / ".env"
if workspace_env.exists():
warning = None
if explicit_path is not None:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if explicit_path.exists():
return explicit_path.resolve(), "WANGQI_ENV_FILE", None
workspace_env = WORKSPACE_DIR / ".env"
if workspace_env.exists():
warning = None
if explicit_path is not None:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if explicit_path.exists():
return explicit_path.resolve(), "WANGQI_ENV_FILE", None
workspace_env = WORKSPACE_DIR / ".env"
if workspace_env.exists():
warning = None
if explicit_path is not None:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if explicit_path.exists():
return explicit_path.resolve(), "WANGQI_ENV_FILE", None
workspace_env = WORKSPACE_DIR / ".env"
if workspace_env.exists():
warning = None
if explicit_path is not None:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if explicit_path.exists():
return explicit_path.resolve(), "WANGQI_ENV_FILE", None
workspace_env = WORKSPACE_DIR / ".env"
if workspace_env.exists():
warning = None
if explicit_path is not None:
The guide shows a complete .env example containing API credential fields populated with key-like values (API_KEY=sk-lm-xxx, EMBEDDING_API_KEY=sk-lm-xxx). While presented as setup help, this natural-language documentation encourages storing and sharing sensitive authentication material directly in visible text, which can lead downstream users or models to reveal or reproduce secrets in responses or logs.
The README explicitly proposes future ingestion of consultation records, which are likely to contain highly sensitive health information, but it only mentions '脱敏处理' briefly and does not provide a clear privacy, consent, retention, access-control, or compliance warning. In a medical/health-related skill, this omission can lead operators to collect and process personal medical data insecurely, increasing the risk of privacy breaches and regulatory noncompliance.
The skill describes operational capabilities such as reading files, writing files, network-backed RAG, ChromaDB access, and knowledge-base maintenance, but does not declare an explicit tool or permission scope. That creates a governance gap: reviewers and runtime policy engines cannot easily constrain the skill to the minimum required capabilities, increasing the chance of unintended file or network access.
Detected: suspicious.exposed_resource_identifier