Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches an AI teaching assistant, but its privacy promises are stronger than its cloud-upload behavior and implemented PII controls.
Install only if you are comfortable with a teaching workflow that may send minimized or derived metadata to configured cloud providers. Treat the zero-upload claim as meaning raw materials are intended to stay local, not that no data ever leaves the machine. Review EDGE_CLOUD_ENDPOINT, API-key handling, model/ffmpeg downloads, and any deployment guide steps before use with student or classroom data.
if script_args is None:
script_args = []
cmd = [str(venv_python), str(SCRIPT_DIR / script_name), *script_args]
return subprocess.run(
cmd,
check=False,
capture_output=capture_output,)
if not os.path.exists(ps_script):
return None
result = subprocess.run(
["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass",
"-File", ps_script, "--probe-only"],
capture_output=True, text=True, timeout=15,):
if hasattr(cost_monitor, attr):
try:
return bool(getattr(cost_monitor, attr))
except Exception:
return False
# 3) 鍏滃簳锛歝umulative_cost_usd >= monthly_budget_usdfor attr in ("cumulative_cost_usd", "cumulative_cost", "total_cost_usd", "cost_usd"):
if hasattr(cost_monitor, attr):
try:
return float(getattr(cost_monitor, attr))
except Exception:
continue
return 0.0for attr in ("monthly_budget_usd", "monthly_budget", "budget_usd", "budget"):
if hasattr(cost_monitor, attr):
try:
v = float(getattr(cost_monitor, attr))
return v
except Exception:
continue"""运行 exe 并尝试给定参数，返回是否成功（用于校验下载是否完整）。"""
for flag in flags:
try:
result = subprocess.run(
[str(exe_path), flag],
capture_output=True,
timeout=15,VENV_DIR.parent.mkdir(parents=True, exist_ok=True)
log.info(f"[venv] 创建统一虚拟环境：{VENV_DIR}")
subprocess.run([sys.executable, "-m", "venv", str(VENV_DIR)], check=True)
if not VENV_PYTHON.exists():
raise RuntimeError(f"虚拟环境创建后未找到 Python：{VENV_PYTHON}")
log.info(f"[venv] ✓ 虚拟环境已就绪：{VENV_PYTHON}")raise FileNotFoundError(f"requirements.txt 不存在：{REQUIREMENTS_FILE}")
log.info(f"[venv] 安装依赖：{REQUIREMENTS_FILE}")
subprocess.run([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run(
[str(venv_python), "-m", "pip", "install", "-r", str(REQUIREMENTS_FILE)],
check=True,log.info(f"[venv] 安装依赖：{REQUIREMENTS_FILE}")
subprocess.run([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run(
[str(venv_python), "-m", "pip", "install", "-r", str(REQUIREMENTS_FILE)],
check=True,
)if not VENV_PYTHON.exists():
return
cmd = [str(VENV_PYTHON), str(script_path), *sys.argv[1:]]
raise SystemExit(subprocess.call(cmd))
def runtime_summary() -> dict[str, str]:if not hasattr(self, attr):
return []
errors: List[Exception] = []
for fn in getattr(self, attr):
try:
fn({"target": None, **payload})
except Exception as e:def add_global(self, event: str, fn) -> None:
attr = f"_global_{event}"
if hasattr(self, attr):
getattr(self, attr).append(fn)
def trigger_global(self, event: str, **payload) -> List[Exception]:
attr = f"_global_{event}"req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
try:
with urllib.request.urlopen(req, timeout=connect_timeout) as resp:
body = resp.read().decode("utf-8")
provider_resp = json.loads(body)
except socket.timeout as exc:req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
try:
with urllib.request.urlopen(req, timeout=connect_timeout) as resp:
body = resp.read().decode("utf-8")
provider_resp = json.loads(body)
except socket.timeout as exc:Detected: suspicious.destructive_delete_command, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal