Security audit
Security checks across malware telemetry and agentic risk
This package is presented mainly as an environment checker, but it also installs packages, runs generated code, executes arbitrary local commands with possible elevation, and stores/deletes local knowledge files.
Install only if you intentionally want the full development-skills bundle, not just an environment checker. Review or disable the code runner, permission managers, and universal command runner; use a virtual environment or sandbox for package installs and generated code; and require explicit human approval for every command, Docker/Ollama action, or sudo/admin path.
for pkg in packages:
try:
print(f"正在安装 {pkg}...")
result = subprocess.run([sys.executable, "-m", "pip", "install", pkg],
capture_output=True, text=True, timeout=300)
if result.returncode == 0:
results.append(f"✓ 成功安装 {pkg}")"""
try:
if language.lower() == "python":
result = subprocess.run([sys.executable, file_path],
capture_output=True, text=True, timeout=30)
return {
"exit_code": result.returncode,# 运行测试
if language.lower() == "python":
# 使用pytest或unittest运行测试
result = subprocess.run([sys.executable, test_file_path],
capture_output=True, text=True, timeout=30)
return {
"test_file": test_file_path,"stderr": result.stderr
}
elif language.lower() == "javascript":
result = subprocess.run(["node", file_path],
capture_output=True, text=True, timeout=30)
return {
"exit_code": result.returncode,"stderr": result.stderr
}
elif language.lower() == "javascript":
result = subprocess.run(["node", test_file_path],
capture_output=True, text=True, timeout=30)
return {
"test_file": test_file_path,"stderr": result.stderr
}
elif language.lower() == "bash" or language.lower() == "shell":
result = subprocess.run(["bash", file_path],
capture_output=True, text=True, timeout=30)
return {
"exit_code": result.returncode,for pkg in packages_to_install:
try:
print(f"正在安装 {pkg}...")
result = subprocess.run([sys.executable, "-m", "pip", "install", pkg],
capture_output=True, text=True, timeout=300)
if result.returncode == 0:
install_result = f"✓ 成功安装 {pkg}"if is_install_command and '--user' not in pip_command:
full_command.insert(3, '--user')
result = subprocess.run(full_command, capture_output=True, text=True, timeout=300)
return {
"status": "success",try:
full_command = ["ollama"] + ollama_command.split()
result = subprocess.run(full_command, capture_output=True, text=True, timeout=300)
return {
"status": "success",# 在普通Linux上可能需要sudo
full_command = ["sudo", "docker"] + docker_command.split()
result = subprocess.run(full_command, capture_output=True, text=True, timeout=300)
return {
"status": "success",# 检查是否已经有管理员权限
if self._check_admin_privileges():
# 直接运行命令
result = subprocess.run(command, shell=True, capture_output=True, text=True, timeout=60)
return {
"status": "success",
"command": command,# 检查是否在WSL中
if self._check_wsl_environment():
# 在WSL中尝试运行命令
result = subprocess.run(command, shell=True, capture_output=True, text=True, timeout=60)
return {
"status": "success",}
else:
# 普通Linux环境，可能需要sudo
result = subprocess.run(['sudo'] + command.split(),
capture_output=True, text=True, timeout=60)
return {尝试运行命令
"""
try:
result = subprocess.run(command, capture_output=True, text=True, timeout=60)
return {
"status": "success" if result.returncode == 0 else "error",# 对于非pip命令，直接返回原命令
return self._try_run_command(command)
result = subprocess.run(new_command, capture_output=True, text=True, timeout=60)
return {
"status": "success" if result.returncode == 0 else "error",# 在WSL中，尝试使用sudo但预期可能失败
new_command = ["sudo"] + command
result = subprocess.run(new_command, capture_output=True, text=True, timeout=60)
return {
"status": "success" if result.returncode == 0 else "error",63/63 vendors flagged this skill as clean.
No suspicious patterns detected.