Security audit
Security checks across malware telemetry and agentic risk
This looks like a real contract-review skill, but it needs Review because it can modify legal documents and the local Python environment without clear enough user control.
Install only in a controlled workspace or virtual environment, preserve original contracts, preinstall reviewed OCR dependencies instead of allowing runtime pip installs, avoid untrusted or unusual filenames until shell invocation is fixed, and have a qualified legal reviewer check the generated revisions and clean copies before relying on them.
def run_cmd(cmd, cwd=None):
"""执行 shell 命令"""
result = subprocess.run(
cmd, shell=True, capture_output=True, text=True, cwd=cwd
)
if result.returncode != 0:shutil.copy(revised_path, tmp_input)
# 使用 LibreOffice 转换为 PDF 再转回 docx（会丢失修订痕迹）
cmd = f'libreoffice --headless --convert-to docx --outdir "{tmpdir}" "{tmp_input}" 2>/dev/null'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
if result.returncode == 0:
converted = Path(tmpdir) / tmp_input.stem.replace('-审查版', '') / '.docx'
if converted.exists():return True
print(f"[安装] 缺少依赖: {', '.join(deps)}")
try:
subprocess.run([sys.executable, '-m', 'pip', 'install', '-q'] + deps,
check=True)
print("[安装] 依赖安装完成")
return True67/67 vendors flagged this skill as clean.
No suspicious patterns detected.