Security checks across malware telemetry and agentic risk
This skill has a coherent multi-agent hub purpose, but its artifacts expose cross-agent messages, tasks, files, memory, and diagnostics more broadly than its security claims disclose.
Use Review rather than outright block: install only in a trusted local environment, bind the server to localhost or otherwise firewall it, do not expose port 3100, avoid enabling optional watcher/runner scripts until reviewed, and assume any registered agent may be able to see or modify more shared hub data than the documentation implies.
"""发送 macOS 系统通知"""
try:
script = f'display notification "{message}" with title "{title}" sound name "Glass"'
subprocess.run(
["osascript", "-e", script],
timeout=5,
capture_output=True,def stop_hub():
"""停止 Hub"""
os.system("lsof -ti:3100 | xargs kill -9 2>/dev/null")
time.sleep(1.5)
def db_setup_agents(agents_tokens: list):print(" ✓ DB 写入完成")
# 启 Hub
os.system(f"cd {HUB_DIR} && {NPX_BIN} tsx src/server.ts > /tmp/hub-p2d2.log 2>&1 &")
for _ in range(15):
time.sleep(1)
code2, _ = http("GET", "/health")def tsx(script: str) -> dict:
"""执行 tsx 脚本，返回 JSON 结果"""
result = subprocess.run(
["npx", "tsx", "-e", script],
capture_output=True, text=True, cwd=os.path.dirname(os.path.dirname(__file__))
)def tsx_eval(code):
"""执行 tsx 代码片段并返回 JSON 结果"""
cmd = ["npx", "tsx", "-e", code]
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=15,
cwd=os.path.join(os.path.dirname(__file__), ".."))
if proc.returncode != 0:
return {"success": False, "error": proc.stderr.strip() or proc.stdout.strip()}with open(tmpfile, 'w') as f:
f.write(script_content)
try:
result = subprocess.run(
['npx', 'tsx', tmpfile],
capture_output=True, text=True, timeout=30, cwd=HUB_ROOT
)with open(tmpfile, 'w') as f:
f.write(script_content)
try:
result = subprocess.run(
['npx', 'tsx', tmpfile],
capture_output=True, text=True, timeout=30, cwd=HUB_ROOT
)tmp_path = os.path.join(HUB_DIR, "_tmp_test_day2.ts")
with open(tmp_path, "w") as f:
f.write(code)
proc = subprocess.run(
["npx", "tsx", tmp_path],
capture_output=True, text=True, cwd=HUB_DIR, timeout=30,
)with open(tmpfile, 'w') as f:
f.write(script_content)
try:
result = subprocess.run(
['npx', 'tsx', tmpfile],
capture_output=True, text=True, timeout=30, cwd=HUB_ROOT
)65/65 vendors flagged this skill as clean.