Security audit
Security checks across malware telemetry and agentic risk
This audio-splitting skill appears to do its advertised job, but it also automatically changes Python environments and downloads tools without a clear consent boundary.
Install only if you are comfortable with the skill creating or modifying a Python environment, installing packages, downloading FFmpeg, writing logs, and generating many output audio files. Prefer running it in an isolated environment, preinstalling verified dependencies, and confirming exact input and output paths before recursive folder processing.
# 🔥 关键：自动输入 Y（默认 yes），彻底无交互
logger.info(" 自动确认下载中...")
subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
# 下载完后刷新模块
importlib.reload(ffdl)"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
logger.info("🔧 正在修复 setuptools 版本（兼容旧 GitHub 包构建）...")
try:
subprocess.check_call([
sys.executable, "-m", "pip", "install",
"--quiet", "--force-reinstall", "setuptools<=81.2.0", "wheel"
])# 第一步：尝试 import 检查（最快）
try:
parts = import_name.split('.')
mod = __import__(parts[0])
for part in parts[1:]:
mod = getattr(mod, part)
if sub_import:cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])
try:
subprocess.check_call(cmd)
logger.info(f"✅ {spec} 安装/升级完成！")
except subprocess.CalledProcessError as e:# ==================== 1. 检查是否已安装 + 版本是否满足 ====================
try:
__import__(import_name)
# 尝试获取当前版本
try:logger.warning(f"🔧 正在安装 {install_str} ...")
try:
subprocess.check_call([
sys.executable, "-m", "pip", "install",
install_str,
"-i", "https://pypi.tuna.tsinghua.edu.cn/simple",sys.executable, "-m", "pip", "install",
"--upgrade", fallback_zip, "--quiet"
]
subprocess.check_call(cmd_fallback)
logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
return
except subprocess.CalledProcessError as e2:logger.info("虚拟环境创建成功")
logger.info("正在升级 pip...")
subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])
# ==================== 检查 PyTorch GPU 是否已安装 ====================
# if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):64/64 vendors flagged this skill as clean.