short-drama
Fail
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The update mechanism in
references/update-mechanism.mdand thebin/update-checkutility fetch shell scripts from the author's GitHub repository (MarkQWu/drama-workshop-skills) and pipe them directly intobash(Mac/Linux) oriex(Windows). This allows for arbitrary code execution from a remote source. - [EXTERNAL_DOWNLOADS]: The skill automatically installs external Python dependencies (
python-docx,lxml) usingpipduring the execution of the/导出command inscripts/export_docx.py. - [COMMAND_EXECUTION]: Several scripts, such as
scripts/character_dev_validate.pyandscripts/export_docx.py, utilize thesubprocess.runfunction to execute system commands, including package managers and other Python scripts. - [DATA_EXFILTRATION]: The skill integrates with a third-party big data service via the
wangwen-bigdataMCP, sending queries to an external API (wwdsj-mcp.lingjingai.cn). Additionally, the version check logic sends local version strings to GitHub.
Recommendations
- AI detected serious security threats
Audit Metadata