← All skills
skills安全审计
55 / 100 · Review before installing
Check before installing.
By infometa/workbuddyskills (GitHub) · other · 443 stars · scanned at commit 33b6151
本skill用于对用户指定的skill.md文件、及其配套的文档、程序、脚本等做安全审查,确保引用安全
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 19 places.
Show 16 more
- plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 171
- `pip3 install`, `python -m pip install` - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 172
- `python3 -m pip install`, `python3.11 -m pip install` - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 173
- `pipx install`(全局安装可执行程序) - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 174
- `easy_install`, `sudo pip install`(更危险!) - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 175
- `pip install --user`(用户级全局) - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 184
- `npm install -g`, `npm i -g` - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 186
- `sudo npm install -g`, `sudo npm i -g` - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 195
- `cargo install`(Rust全局安装) - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 196
- `go install`, `go get`(Go全局安装) - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 198
- `brew install`(macOS系统级) - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 224
- `pip install -i <非官方镜像源>` - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 225
- `pip install <包名> --index-url <可疑URL>` - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 227
- 从GitHub等代码托管平台直接安装(`pip install git+https://...`)需要特别审查 - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 266
- ✅ **下载 + 执行**:skill自动从远程下载内容并执行(如 `curl | bash`、下载脚本后 `eval`) - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 270
- ✅ **权限提升 + 危险操作**:`sudo`/`chmod 777` 配合上述危险操作(如 `sudo curl | bash`、`sudo rm -rf /`) - plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit/SKILL.md, line 274
- skill**自动执行全局安装**依赖:`pip install`(非虚拟环境)、`npm install -g`(环境破坏风险,但被安装包是否投毒超出审计能力)
Runs commands on your computer
The author does not mention this.
Found in 1 place.
Connects to the internet
The author does not mention this.
Found in 4 places.
Show 1 more
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this.
Found in 1 place.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'skills' ] || [ -L ~/.agents/skills/'skills' ]; then echo 'A skill folder named skills already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/infometa/workbuddyskills' "$d" && git -C "$d" checkout --quiet '33b6151ccee9aa0816c6f32d021be77d82772755' -- 'plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/codebuddy-plugins-official/plugins/skills-sec-audit/skills/skills-sec-audit' ~/.agents/skills/'skills' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'skills' ~/.claude/skills/'skills' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for infometa/workbuddyskills shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/infometa/workbuddyskills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-13 | 33b6151 | 55 |
| 2026-11-09 | 0749999 | 55 |
| 2026-11-07 | 1e18d8c | 100 |