← All skills
skills-security-check
40 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By infometa/workbuddyskills (GitHub) · security · 427 stars · scanned at commit 0749999
腾讯云鼎实验室出品，Skill安全审查工具。对用户指定的skill.md文件及其配套的文档、程序、脚本等进行全面安全审计，确保引用安全
Works with any agent that supports SKILL.md skills.
What this skill can do
Contains code that is hidden or hard to read
The author does not mention this.
Found in 1 place.
Downloads and installs other software
The author does not mention this.
Found in 15 places.
Show 12 more
- skills/skills-security-check/SKILL.md, line 133
**触发条件**：步骤2-3中发现 skill 自动下载并执行远程脚本（如 `curl | bash`、`wget | sh`、下载后执行等）时，**必须**用 `web_fetch` 抓取远程 URL 的文本内容进行静态分析（只读取，不执行）。 - skills/skills-security-check/SKILL.md, line 145
| **二次下载+执行** | 脚本内部再次 `curl \| bash`、`wget` 下载并执行其他脚本 | 🔴 几乎总是恶意的（链式下载极难审计），除非来源为同一官方域名且有明确必要性 | - skills/skills-security-check/SKILL.md, line 183
- ✅ **固定版本** + 全局安装 → 不报风险（如 `pip install requests==2.28.1`） - skills/skills-security-check/SKILL.md, line 184
- ⚠️ **未固定版本** + 全局安装 → Suspicious（如 `pip install requests`、`npm install -g tool`） - skills/skills-security-check/SKILL.md, line 188
- **Python**：`pip install <包名>`（无 `==`/`>=`/`~=` 版本号）、`pip3 install`、`sudo pip install` - skills/skills-security-check/SKILL.md, line 189
- **Node.js**：`npm install -g <包名>`（无 `@version`）、`yarn global add`、`pnpm add -g` - skills/skills-security-check/SKILL.md, line 190
- **其他**：`gem install`、`cargo install`、`go install`、`brew install` - skills/skills-security-check/SKILL.md, line 196
- `pip install -i <非官方镜像源>` / `--index-url <可疑URL>`（无法验证源安全性） - skills/skills-security-check/SKILL.md, line 252
- ✅ **下载 + 执行**：skill自动从远程下载内容并执行（如 `curl | bash`、下载脚本后 `eval`） - skills/skills-security-check/SKILL.md, line 264
- ✅ **权限提升 + 危险操作**：`sudo`/`chmod 777` 配合上述危险操作（如 `sudo curl | bash`、`sudo rm -rf /`） - skills/skills-security-check/SKILL.md, line 270
- skill **自动执行全局安装未固定版本**的依赖（如 `pip install requests`、`npm install -g tool`） - skills/skills-security-check/SKILL.md, line 272
- 不报风险情况：已固定版本（如 `pip install requests==2.28.1`）或在虚拟环境中安装
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 2 places.
Connects to the internet
The author does not mention this. Expected for a security skill.
Found in 3 places.
Can call paid AI services billed to you
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'skills-security-check' ] || [ -L ~/.agents/skills/'skills-security-check' ]; then echo 'A skill folder named skills-security-check already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/infometa/workbuddyskills' "$d" && git -C "$d" checkout --quiet '0749999031be0d5fa14cdc08afe9cefdf857cbfd' -- 'skills/skills-security-check' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/skills-security-check' ~/.agents/skills/'skills-security-check' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'skills-security-check' ~/.claude/skills/'skills-security-check' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for infometa/workbuddyskills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/infometa/workbuddyskills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-09 | 0749999 | 40 |
| 2026-11-07 | 1e18d8c | 100 |