Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real office-dashboard skill, but it combines public exposure, weak default controls, background status sharing, and local data/API-key handling in a way users should review before installing.
Install only if you are comfortable running a local web service that can be exposed publicly. Before using any public URL, set strong FLASK_SECRET_KEY and ASSET_DRAWER_PASS values, rotate or replace default join keys, disable or protect memo display if it may contain private notes, and avoid entering a Gemini API key unless you understand where it is stored and who can reach the dashboard.
f"magick '{td}/f_*.png'{prep} "
f"-tile {cols_eff}x{rows_eff} -background none -geometry +0+0 {quality_flag} '{out_path}'"
)
rc = os.system(cmd)
if rc != 0:
raise RuntimeError("ImageMagick 拼图失败")
return out_path, cols_eff, rows_eff, frames, out_fw, out_fhf"-vf '{vf}' "
f"{ffmpeg_quality} '{out_path}' >/dev/null 2>&1"
)
if os.system(cmd2) != 0:
raise RuntimeError("ffmpeg 拼图失败")
return out_path, frames, 1, frames, out_fw, out_fhif frames <= 0:
cmd1 = f"ffmpeg -y -i '{upload_path}' '{td}/f_%04d.png' >/dev/null 2>&1"
if os.system(cmd1) != 0:
raise RuntimeError("动图抽帧失败（Pillow/ffmpeg 都失败）")
files = sorted([x for x in os.listdir(td) if x.startswith("f_") and x.endswith(".png")])
frames = len(files)headers = {}
if LOCAL_STATUS_TOKEN:
headers["Authorization"] = f"Bearer {LOCAL_STATUS_TOKEN}"
r = requests.get(LOCAL_STATUS_URL, headers=headers, timeout=5)
if r.status_code == 200:
data = r.json()
state = normalize_state(data.get("state", "idle"))}
def save_state(state):
with open(STATE_FILE, "w", encoding="utf-8") as f:
json.dump(state, f, ensure_ascii=False, indent=2)
if __name__ == "__main__":61/61 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.install_untrusted_source