Security audit
Security checks for vulnerabilities and agentic risk
This skill is a tool-calling helper, but its dispatcher can run shell commands and Python functions while overstating its validation and confirmation safeguards.
Review before installing. Use this only with registries and arguments you trust, and do not feed unreviewed model-generated values into command templates. The dispatcher can execute arbitrary local shell commands or Python functions defined by the registry, and the documented safety checks are stronger than the implementation. The learner feature can also persist usage notes and preferences in learned_patterns.json for supplied skill directories.
t = entry.get("type", "command")
if t == "command":
cmd = entry["cmd"].format(**args)
r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
return r.returncode == 0, (r.stdout or r.stderr).strip()
if t == "python":
mod = __import__(entry["module"])r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
return r.returncode == 0, (r.stdout or r.stderr).strip()
if t == "python":
mod = __import__(entry["module"])
fn = getattr(mod, entry["func"])
res = fn(**args)
return True, str(res)return r.returncode == 0, (r.stdout or r.stderr).strip()
if t == "python":
mod = __import__(entry["module"])
fn = getattr(mod, entry["func"])
res = fn(**args)
return True, str(res)
return False, f"未知工具类型: {t}"t = entry.get("type", "command")
if t == "command":
cmd = entry["cmd"].format(**args)
r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
return r.returncode == 0, (r.stdout or r.stderr).strip()
if t == "python":
mod = __import__(entry["module"])t = entry.get("type", "command")
if t == "command":
cmd = entry["cmd"].format(**args)
r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
return r.returncode == 0, (r.stdout or r.stderr).strip()
if t == "python":
mod = __import__(entry["module"])No suspicious patterns detected.