Security audit
Security checks across malware telemetry and agentic risk
This audio-recording skill has a plausible purpose, but it automatically modifies Python environments and downloads/install components in ways that are broader and less disclosed than a user would expect.
Install only if you are comfortable with a skill that records system audio and may automatically install Python packages, alter packaging tools, create a virtual environment, download FFmpeg, write recordings/logs locally, and listen for ESC while recording. Prefer reviewing or changing the setup so dependency installation is an explicit one-time step in an isolated environment before use.
"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
try:
# 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
subprocess.check_call([
sys.executable, "-m", "pip", "install",
"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
])"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
])
# 再安装兼容的 setuptools + wheel
subprocess.check_call([
sys.executable, "-m", "pip", "install",
"--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
])# ==================== 后续安装与回退逻辑保持不变 ====================
try:
subprocess.check_call(cmd)
logger.info(f"✅ {spec} 安装/升级完成！")
except subprocess.CalledProcessError as e:logger.warning(f"🔧 正在安装 {install_str} ...")
try:
subprocess.check_call([
sys.executable, "-m", "pip", "install",
install_str,
"-i", "https://pypi.tuna.tsinghua.edu.cn/simple",sys.executable, "-m", "pip", "install",
"--upgrade", fallback_zip, "--verbose"
]
subprocess.check_call(cmd_fallback)
logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
return
except subprocess.CalledProcessError as e2:logger.info("虚拟环境创建成功")
logger.info("正在升级 pip...")
subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])
# ==================== 检查 PyTorch GPU 是否已安装 ====================
# if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):# 🔥 关键：自动输入 Y（默认 yes），彻底无交互
logger.info(" 自动确认下载中...")
subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
# 下载完后刷新模块
importlib.reload(ffdl)VirusTotal findings are pending for this skill version.
No suspicious patterns detected.