Security audit
Security checks across malware telemetry and agentic risk
This is a disclosed educational security lab, but it can run real local commands and code and its safety boundaries are weaker than the packaging implies.
Install only if you intentionally want a hands-on defensive security lab. Run it in a disposable container, VM, or throwaway workspace with no sensitive files mounted, and do not grant it broad access to your normal home directory. Treat the vaccine files as educational examples, not production-ready security patches, and use the skill only on the included mock systems or targets you are clearly authorized to test.
# This is FLAWED - should never use eval with user input
try:
# 模拟安全执行 (simulating safe execution - but it's NOT safe)
result = eval(code)
return {"safe": True, "result": result}
except Exception as e:
return {"safe": False, "error": str(e)}# Deliberately FLAWED - shell injection possible
try:
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=5)
return {"safe": True, "output": result.stdout, "error": result.stderr}
except Exception as e:
return {"safe": False, "error": str(e)}65/65 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution, suspicious.prompt_injection_instructions