skills-security-check

40 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By ahang1598/doubao-workbuddy-qwenwork-skills (GitHub) · security · 97 stars · scanned at commit 5e45653

腾讯云鼎实验室出品，Skill安全审查工具。对用户指定的skill.md文件及其配套的文档、程序、脚本等进行全面安全审计，确保引用安全

Works with any agent that supports SKILL.md skills.

What this skill can do

Contains code that is hidden or hard to read

The author does not mention this.

Found in 1 place.

workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 26- 任何 `echo ... | base64 -d | bash` 或 `echo ... | base64 -D | bash` 形式的命令

Downloads and installs other software

The author does not mention this.

Found in 12 places.

workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 63| skill自动执行 `curl \| bash` | ✅**需报告** | skill自动执行远程脚本，触发步骤4深度分析后根据远程内容定级（P0或P1） |
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 64| 配套脚本 `init.sh`包含 `npm install -g` | ✅**需报告** | skill自动执行全局安装，需结合安装内容判断风险：安装已知官方工具（如 typescript）→ 风险较低；安装未知包 → 风险较高 |
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 127**触发条件**：步骤2-3中发现 skill 自动下载并执行远程脚本（如 `curl | bash`、`wget | sh`、下载后执行等）时，**必须**用 `web_fetch` 抓取远程 URL 的文本内容进行静态分析（只读取，不执行）。

Show 9 more

workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 139| **二次下载+执行** | 脚本内部再次 `curl \| bash`、`wget` 下载并执行其他脚本 | 🔴 几乎总是恶意的（链式下载极难审计），除非来源为同一官方域名且有明确必要性 |
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 174- **Python**：`pip install`（非虚拟环境）、`pip3 install`、`python -m pip install`、`pipx install`、`sudo pip install`
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 175- **Node.js**：`npm install -g`、`npm i -g`、`yarn global add`、`pnpm add -g`
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 176- **其他**：`gem install`、`cargo install`、`go install`、`composer global require`、`brew install`
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 183- `pip install -i <非官方镜像源>` / `--index-url <可疑URL>`
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 185- 从代码仓库直接安装（`pip install git+https://...`）
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 237- ✅ **下载 + 执行**：skill自动从远程下载内容并执行（如 `curl | bash`、下载脚本后 `eval`）
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 249- ✅ **权限提升 + 危险操作**：`sudo`/`chmod 777` 配合上述危险操作（如 `sudo curl | bash`、`sudo rm -rf /`）
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 255- skill**自动执行全局安装**依赖：`pip install`（非虚拟环境）、`npm install -g`（环境破坏风险，但被安装包是否投毒超出审计能力）

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 2 places.

workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 90- 多语言变种：`os.popen()`, `Popen()`, `call()`, `check_output()`
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 217→ 不属于危险操作（如 os.popen('date') 获取时间戳、subprocess(['git','status']) 只读操作等）

Connects to the internet

The author does not mention this. Expected for a security skill.

Found in 3 places.

workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 101- `curl`, `wget`, `fetch`, `axios`, `requests.get`, `requests.post`, `urllib`
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 102- `httpx`, `aiohttp`, `got`, `node-fetch`, `XMLHttpRequest`, `$.ajax`
workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 140| **数据外送** | `curl -d`、`wget --post-data`、`nc` 等向外发送数据 | 需同时看**发送内容**和**目标地址**：敏感信息发送到未知第三方域名 → 🔴恶意；向官方域名发送非敏感数据 → ✅常见 |

Can call paid AI services billed to you

The author does not mention this.

Found in 1 place.

workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check/SKILL.md, line 241- ⚠️ **降级条件**：读取特定凭证调用其对应的官方服务（如读取 `OPENAI_API_KEY` 调用 `api.openai.com`），或通过 SSH 协议使用 SSH key → 降为 **P1**

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'skills-security-check' ] || [ -L ~/.agents/skills/'skills-security-check' ]; then echo 'A skill folder named skills-security-check already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/ahang1598/doubao-workbuddy-qwenwork-skills' "$d" && git -C "$d" checkout --quiet '5e45653f59a2e4a2a65f575e8aaf7637165674d5' -- 'workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check' && mkdir -p ~/.agents/skills && cp -R "$d"/'workbuddy/official_experts/plugins/skills-security-check/skills/skills-security-check' ~/.agents/skills/'skills-security-check' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'skills-security-check' ~/.claude/skills/'skills-security-check' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for ahang1598/doubao-workbuddy-qwenwork-skills shows the score of its lowest-scoring skill.

SkillTrust badge for ahang1598/doubao-workbuddy-qwenwork-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/ahang1598/doubao-workbuddy-qwenwork-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/ahang1598/doubao-workbuddy-qwenwork-skills/)

Score history

Date	Version	Score
2026-11-07	`5e45653`	40

Also found in

Identical copies of this skill exist at:

infometa/workbuddyskills/plugins/codebuddy-plugins-official/plugins/skills-security-check/skills/skills-security-check