Security audit
Security checks across malware telemetry and agentic risk
This Chinese text-correction skill has a plausible core purpose, but it also automatically changes Python environments, installs broad unpinned packages, and can bulk-process local files, so it needs review before installation.
Install only in an isolated environment if you are comfortable with automatic package installation, model downloads, GPU probing, local logging, and generated corrected copies of files. Avoid running it on broad private folders or source-code directories, and review output files before using them.
"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
logger.info("🔧 正在修复 setuptools 版本（兼容旧 GitHub 包构建）...")
try:
subprocess.check_call([
sys.executable, "-m", "pip", "install",
"--quiet", "--force-reinstall", "setuptools<=81.2.0", "wheel"
])cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])
try:
subprocess.check_call(cmd)
logger.info(f"✅ {spec} 安装/升级完成！")
except subprocess.CalledProcessError as e:logger.warning(f"🔧 正在安装 {install_str} ...")
try:
subprocess.check_call([
sys.executable, "-m", "pip", "install",
install_str,
"-i", "https://pypi.tuna.tsinghua.edu.cn/simple",sys.executable, "-m", "pip", "install",
"--upgrade", fallback_zip, "--quiet"
]
subprocess.check_call(cmd_fallback)
logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
return
except subprocess.CalledProcessError as e2:logger.info("虚拟环境创建成功")
logger.info("正在升级 pip...")
subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])
# ==================== 检查 PyTorch GPU 是否已安装 ====================
if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):# 安装 PyTorch
logger.info("正在安装 PyTorch（~2-3GB，请耐心等待）...")
subprocess.check_call([
str(venv_python), "-m", "pip", "install", "torch", "torchvision", "torchaudio",
"--index-url", index_url
])logger.info("安装 audio-separator CPU 版 + librosa...")
subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])
subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
logger.info("✅ 虚拟环境及所有依赖安装完成！")subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])
subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
logger.info("✅ 虚拟环境及所有依赖安装完成！")# 安装 audio-separator + librosa（你提到的）
if use_gpu:
logger.info("安装 audio-separator GPU 版 + librosa...")
subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
else:
logger.info("安装 audio-separator CPU 版 + librosa...")
subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
else:
logger.info("安装 audio-separator CPU 版 + librosa...")
subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])
subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])63/63 vendors flagged this skill as clean.
No suspicious patterns detected.