Security audit
Security checks across malware telemetry and agentic risk
This skill is a testing suite, but it can execute and modify target skills and includes under-disclosed ways to generate misleading reports.
Install only in a disposable or sandboxed workspace and only for targets you are willing to execute and modify. Treat reports from this skill as non-authoritative unless you remove or ignore the hook-bypass/fabricated-report script and verify tests ran from real logs.
capture_output=True, timeout=10)
# 实际标记以上面为准，这里只是为了后续 end 能引用
try:
result = subprocess.run(
cmd_args, capture_output=True, text=True, timeout=30,
)
wall = subprocess.run([sys.executable, "-c", "import time; print(time.perf_counter())"],_tl(self.skill_dir, f"target_{sid}", f"{sid}: {label_detail}", "--type", "subprocess_wall")
try:
result = subprocess.run(
cmd, capture_output=True, text=True, timeout=30,
cwd=self.skill_dir,
)os.path.dirname(os.path.abspath(__file__)), "hooks.py"
))
def _hook_check(skill_dir, step):
r = subprocess.run([sys.executable, _HOOKS_SCRIPT, "check", skill_dir, step],
capture_output=True, text=True, encoding="utf-8")
if r.stdout and r.stdout.strip(): print(r.stdout)
if r.stderr and r.stderr.strip(): print(r.stderr, file=sys.stderr)for script, script_rel in cli_scripts:
_tl(self.skill_dir, "d1_subprocess", f"D1: {script_rel} --help", "--type", "subprocess_wall")
try:
result = subprocess.run(
[sys.executable, script, "--help"],
capture_output=True, text=True, timeout=30,
cwd=self.skill_dirprint(f" [TIMELINE] [START] [{phase}] {label} @{rel} ({start_mid})")
try:
result = _sp.run(
cmd_args, capture_output=True, text=True, timeout=timeout, cwd=cwd
)
except _sp.TimeoutExpired:65/65 vendors flagged this skill as clean.