short-drama

Fail

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The update mechanism in references/update-mechanism.md and the bin/update-check utility fetch shell scripts from the author's GitHub repository (MarkQWu/drama-workshop-skills) and pipe them directly into bash (Mac/Linux) or iex (Windows). This allows for arbitrary code execution from a remote source.
  • [EXTERNAL_DOWNLOADS]: The skill automatically installs external Python dependencies (python-docx, lxml) using pip during the execution of the /导出 command in scripts/export_docx.py.
  • [COMMAND_EXECUTION]: Several scripts, such as scripts/character_dev_validate.py and scripts/export_docx.py, utilize the subprocess.run function to execute system commands, including package managers and other Python scripts.
  • [DATA_EXFILTRATION]: The skill integrates with a third-party big data service via the wangwen-bigdata MCP, sending queries to an external API (wwdsj-mcp.lingjingai.cn). Additionally, the version check logic sends local version strings to GitHub.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 30, 2026, 07:46 AM