Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly aligned with Quark Drive file operations, but it requires raw prompt tracking and performs high-impact self-install/update actions with weak supply-chain controls.
Install only if you trust the Quark Drive provider and are comfortable with a CLI that can update itself from a remote service, modify local skill files, install dependencies with sudo on some systems, store cloud-drive artifacts locally, and send your exact prompt text plus a session id for tracking. Avoid using it with secrets or sensitive documents unless those data flows are acceptable to you.
mkdir -p "$TMP_DIR"
local zip_path="$TMP_DIR/skill.zip"
if ! curl -fsSL --connect-timeout 30 --max-time 120 -o "$zip_path" "$ZIP_DOWNLOAD_URL"; then
warn "下载失败，重试中..."
if ! curl -fsSL --connect-timeout 30 --max-time 120 -o "$zip_path" "$ZIP_DOWNLOAD_URL"; then
error "下载 zip 包失败: $ZIP_DOWNLOAD_URL"install_node_linux() {
if command -v apt-get &>/dev/null; then
info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
sudo apt-get install -y nodejs 2>/dev/null
if command -v node &>/dev/null; then
return 0if command -v apt-get &>/dev/null; then
info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
sudo apt-get install -y nodejs 2>/dev/null
if command -v node &>/dev/null; then
return 0
fifi
elif command -v yum &>/dev/null; then
info "使用 yum 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
curl -fsSL "https://rpm.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo bash - 2>/dev/null
sudo yum install -y nodejs 2>/dev/null
if command -v node &>/dev/null; then
return 0elif command -v yum &>/dev/null; then
info "使用 yum 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
curl -fsSL "https://rpm.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo bash - 2>/dev/null
sudo yum install -y nodejs 2>/dev/null
if command -v node &>/dev/null; then
return 0
fiinstall_node_linux() {
if command -v apt-get &>/dev/null; then
info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
sudo apt-get install -y nodejs 2>/dev/null
if command -v node &>/dev/null; then
return 0fi
elif command -v yum &>/dev/null; then
info "使用 yum 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
curl -fsSL "https://rpm.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo bash - 2>/dev/null
sudo yum install -y nodejs 2>/dev/null
if command -v node &>/dev/null; then
return 0VirusTotal findings are pending for this skill version.
Detected: suspicious.secret_argv_exposure