Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real AI teaching assistant, but its privacy and offline claims are stronger than the code actually supports, so it needs review before use with student data.
Install only if you are comfortable reviewing and controlling its network use. Treat “zero-upload” as “raw course files are intended to stay local, but abstracted metadata may be sent to a configured cloud endpoint,” not as a guarantee that nothing leaves the machine. Avoid using it with real student identifiers, grades, answers, or sensitive family data until the publisher aligns the privacy docs with implementation, adds explicit permissions, and documents endpoint/provider controls and data retention clearly.
if script_args is None:
script_args = []
cmd = [str(venv_python), str(SCRIPT_DIR / script_name), *script_args]
return subprocess.run(
cmd,
check=False,
capture_output=capture_output,)
if not os.path.exists(ps_script):
return None
result = subprocess.run(
["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass",
"-File", ps_script, "--probe-only"],
capture_output=True, text=True, timeout=15,):
if hasattr(cost_monitor, attr):
try:
return bool(getattr(cost_monitor, attr))
except Exception:
return False
# 3) 鍏滃簳锛歝umulative_cost_usd >= monthly_budget_usdfor attr in ("cumulative_cost_usd", "cumulative_cost", "total_cost_usd", "cost_usd"):
if hasattr(cost_monitor, attr):
try:
return float(getattr(cost_monitor, attr))
except Exception:
continue
return 0.0for attr in ("monthly_budget_usd", "monthly_budget", "budget_usd", "budget"):
if hasattr(cost_monitor, attr):
try:
v = float(getattr(cost_monitor, attr))
return v
except Exception:
continue"""运行 exe 并尝试给定参数，返回是否成功（用于校验下载是否完整）。"""
for flag in flags:
try:
result = subprocess.run(
[str(exe_path), flag],
capture_output=True,
timeout=15,VENV_DIR.parent.mkdir(parents=True, exist_ok=True)
log.info(f"[venv] 创建统一虚拟环境：{VENV_DIR}")
subprocess.run([sys.executable, "-m", "venv", str(VENV_DIR)], check=True)
if not VENV_PYTHON.exists():
raise RuntimeError(f"虚拟环境创建后未找到 Python：{VENV_PYTHON}")
log.info(f"[venv] ✓ 虚拟环境已就绪：{VENV_PYTHON}")raise FileNotFoundError(f"requirements.txt 不存在：{REQUIREMENTS_FILE}")
log.info(f"[venv] 安装依赖：{REQUIREMENTS_FILE}")
subprocess.run([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run(
[str(venv_python), "-m", "pip", "install", "-r", str(REQUIREMENTS_FILE)],
check=True,log.info(f"[venv] 安装依赖：{REQUIREMENTS_FILE}")
subprocess.run([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"], check=True)
subprocess.run(
[str(venv_python), "-m", "pip", "install", "-r", str(REQUIREMENTS_FILE)],
check=True,
)if not VENV_PYTHON.exists():
return
cmd = [str(VENV_PYTHON), str(script_path), *sys.argv[1:]]
raise SystemExit(subprocess.call(cmd))
def runtime_summary() -> dict[str, str]:if not hasattr(self, attr):
return []
errors: List[Exception] = []
for fn in getattr(self, attr):
try:
fn({"target": None, **payload})
except Exception as e:def add_global(self, event: str, fn) -> None:
attr = f"_global_{event}"
if hasattr(self, attr):
getattr(self, attr).append(fn)
def trigger_global(self, event: str, **payload) -> List[Exception]:
attr = f"_global_{event}"req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
try:
with urllib.request.urlopen(req, timeout=connect_timeout) as resp:
body = resp.read().decode("utf-8")
provider_resp = json.loads(body)
except socket.timeout as exc:req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
try:
with urllib.request.urlopen(req, timeout=connect_timeout) as resp:
body = resp.read().decode("utf-8")
provider_resp = json.loads(body)
except socket.timeout as exc:65/65 vendors flagged this skill as clean.
Detected: suspicious.destructive_delete_command, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal