!
Purpose & Capability
The skill's functionality (punctuation restoration) matches use of FunASR and model downloads, but the code also downgrades setuptools and runs pip installs using the current Python interpreter at import time. These global changes and shared venv placement (VENV_DIR is outside the skill folder) are not necessary for the simple stated task and are disproportionate.
!
Instruction Scope
SKILL.md documents running scripts with --text/--file/--dir and creating a local venv. However, the implementation performs additional actions not clearly described: it invokes ensure_package at import time (which triggers global pip installs and setuptools modification), probes system NVIDIA tools (nvidia-smi), and can walk arbitrary directories when processing a --dir. The import-time side effects (package installs) are not mentioned in the runtime instructions.
!
Install Mechanism
There is no formal install spec, but the code will dynamically pip install multiple packages and download remote model artifacts from ModelScope and PyTorch wheel hosts at runtime. That network-based install behavior is expected for model-backed tools, but the fact that ensure_package.forcefully modifies setuptools and performs pip installs before creating an isolated venv increases risk and surprises users.
!
Credentials
The skill requests no explicit credentials, but it modifies the runtime environment: fix_setuptools_for_legacy_packages() runs at import time and issues a pip install to force setuptools<=81.2.0 using the running interpreter, and ensure_package.pip may install packages into the current environment. VENV_DIR points to a parent-level 'venv' (potentially a shared location), which may alter/override other skills or system behaviour — this is disproportionate for a punctuation-only skill.
!
Persistence & Privilege
always:false and user-invocable:true (normal), but the skill persists large artifacts: it creates a venv (in a shared location), caches models under models/, and writes logs to LOG_DIR. Creating/updating a shared venv and downgrading setuptools increases long-term impact on the host environment.
What to consider before installing
What to consider before installing/running this skill:
- It will perform network downloads (PyPI, ModelScope, PyTorch wheels) and may install large packages (torch) and a model (~GBs). Expect significant disk, network, and time use.
- The code forcibly downgrades setuptools (pip install setuptools<=81.2.0) as soon as the module is imported; that modifies the current Python environment before any isolated venv is created. If you run this inside a shared/system Python, that can break other tooling.
- The venv is created at a parent-level path (VENV_DIR), likely shared across skills; this can modify a shared environment. Consider running the skill only in an isolated container or explicitly editing config to point VENV_DIR to a directory you control.
- The script will probe system interfaces (nvidia-smi) and may run subprocesses; review and run in a sandbox if you don't trust network installs.
- If you want to proceed safely: run the code in an isolated VM/container, or modify the code so installs happen inside a pre-created isolated venv (and remove the global setuptools downgrade), or run manually after auditing the pip targets and model URLs.
- Things that would make this benign: removing import-time global pip actions (no global setuptools change), creating the venv inside the skill folder (not a shared parent venv), and documenting all runtime installs in SKILL.md so the user understands network and environment changes.
