Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it builds a local text corpus and can optionally send text to DashScope for AI annotation, with some operational risks users should manage.
Install only if you are comfortable with the skill creating local corpus files that may contain your original text and embeddings. Unset DASHSCOPE_API_KEY to keep annotation offline; if you use LLM mode, assume text chunks are sent to DashScope. Prefer a secret manager or temporary environment variable over storing API keys in ~/.bashrc, and verify any rm -rf path before running cleanup commands.
# Corpus Builder - Requirements # ChromaDB 向量数据库 chromadb>=0.5.0 # 嵌入模型（语义向量化） sentence-transformers>=2.2.2
chromadb>=0.5.0 # 嵌入模型（语义向量化） sentence-transformers>=2.2.2 # 配置文件解析 pyyaml>=6.0.1
sentence-transformers>=2.2.2 # 配置文件解析 pyyaml>=6.0.1 # CLI 美化输出 rich>=13.7.0
pyyaml>=6.0.1 # CLI 美化输出 rich>=13.7.0 # 内存监控 psutil>=5.9.8
rich>=13.7.0 # 内存监控 psutil>=5.9.8 # sqlite3 版本兼容（ChromaDB 需要 sqlite3 >= 3.35.0） # 如果系统 sqlite3 版本过低，安装此包作为替代
# sqlite3 版本兼容（ChromaDB 需要 sqlite3 >= 3.35.0） # 如果系统 sqlite3 版本过低，安装此包作为替代 pysqlite3-binary>=0.5.2 # LLM API 调用（AI 标注） # 使用 OpenAI 兼容 API 调用 DashScope Coding
# LLM API 调用（AI 标注） # 使用 OpenAI 兼容 API 调用 DashScope Coding openai>=1.0.0
```bash
# 删除向量库重新构建
rm -rf corpus/chroma/{collection_name}
python3 scripts/build_corpus.py --source ~/novels/reference --name test
```No suspicious patterns detected.