Security checks across malware telemetry and agentic risk
The skill does convert MP4 files to MP3, but it also automatically installs packages, downloads FFmpeg, and changes Python environments without clear user control.
Review before installing. Use this only in a disposable or dedicated environment if you are comfortable with it installing Python packages, changing packaging tools, downloading FFmpeg, writing logs, and generating MP3 files under the selected output path. Prefer preinstalling FFmpeg and dependencies yourself, and avoid using it for URL downloads unless that workflow is separately reviewed and explicitly approved.
"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
logger.info("🔧 正在修复 setuptools 版本（兼容旧 GitHub 包构建）...")
try:
subprocess.check_call([
sys.executable, "-m", "pip", "install",
"--quiet", "--force-reinstall", "setuptools<=81.2.0", "wheel"
])cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])
try:
subprocess.check_call(cmd)
logger.info(f"✅ {spec} 安装/升级完成！")
except subprocess.CalledProcessError as e:logger.warning(f"🔧 正在安装 {install_str} ...")
try:
subprocess.check_call([
sys.executable, "-m", "pip", "install",
install_str,
"-i", "https://pypi.tuna.tsinghua.edu.cn/simple",sys.executable, "-m", "pip", "install",
"--upgrade", fallback_zip, "--quiet"
]
subprocess.check_call(cmd_fallback)
logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
return
except subprocess.CalledProcessError as e2:# 🔥 关键：自动输入 Y（默认 yes），彻底无交互
logger.info(" 自动确认下载中...")
subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
# 下载完后刷新模块
importlib.reload(ffdl)65/65 vendors flagged this skill as clean.