跳转到正文
报告库
用途分类 / 文档处理

Repo Intake And Plan Skill 安全审计

作者说它能做什么(原文)

Rigor Intake helper for README-first deep learning repo reproduction. Use when the task is specifically to scan a repository, read the README and common project files, extract documented commands, classify inference, evaluation, and training candidates, and return the smallest trustworthy reproduction plan to the main orchestrator. Do not use for environment setup, asset download, command executio

第三方安全检查结论

发现安全风险

已检查文件
5
发现的风险
2
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。未发现风险
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。未发现风险
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。发现 1 项风险
中风险

README 标题可使训练命令被优先标为推理或评估

原文依据:6 处
发现了什么

分类器在检查入口脚本名称之前就接受章节标题的分类。例如,位于“Demo”章节中的 train.py 会先被标为推理。后续结构检查仅在脚本可解析、位于目录内、不超过 512 KiB,且检测分数达到阈值时才改回训练;模块入口、缺失脚本或不匹配其有限模式的训练代码可能绕过纠正。

为什么需要注意

如果下游把分类用作训练授权或成本控制门槛,实际训练任务可能被当作较低风险的推理或评估任务,消耗大量计算资源、修改模型输出或启动长时间作业。

该分类绕过成立。`classify` 在入口脚本规则之前直接返回章节分类,所以“Demo”下的 `train.py` 最初会成为 inference。纠正机制只检查仓库目录内、存在且不超过 512 KiB 的直接 `.py` 路径,并要求有限训练特征总分至少为 4;模块入口、缺失/较大脚本或采用其他训练结构的代码不会被纠正。这可能使计划把训练误当成较低风险推理,但本技能自身仍不执行它。用户可要求作者让明确的训练入口优先于标题,并把无法检查的入口标为不确定。

scripts/extract_commands.py:84来自代码打开原文件
    # authorization when both appear in the same title.    if any(word in lowered for word in ["training", "train", "finetune", "fine-tune", "pretrain"]):        return "training"    if any(word in lowered for word in ["evaluation", "evaluate", "benchmark", "metrics", "validation"]) or re.search(        r"\b(?:test|tests|testing)\b", lowered    ):        return "evaluation"    if any(word in lowered for word in ["inference", "usage", "demo", "example", "text-to-image", "image-to-image", "transcribe"]):        return "inference"    return None
查看另外 5 个位置
scripts/extract_commands.py:138来自代码打开原文件
    section_category = infer_section_category(section)    if section_category:        return section_category    for pattern, category in SCRIPT_CATEGORY_HINTS:        if pattern.search(lowered):            return category
scripts/extract_commands.py:237来自代码打开原文件
def referenced_python_script(command: str, readme_dir: Path) -> Optional[Path]:    matched = PYTHON_ENTRYPOINT_RE.search(command)    if not matched:        return None    root = readme_dir.resolve()    candidate = (root / matched.group("path")).resolve()    try:        candidate.relative_to(root)    except ValueError:        return None    if not candidate.is_file() or candidate.stat().st_size > 524_288:        return None    return candidate
scripts/extract_commands.py:257来自代码打开原文件
        return []    evidence: List[str] = []    score = 0    for label, pattern, weight in TRAINING_STRUCTURE_SIGNALS:        if pattern.search(content):            evidence.append(label)            score += weight    return evidence if score >= 4 else []
scripts/extract_commands.py:77来自代码打开原文件
def infer_section_category(section: Optional[str]) -> Optional[str]:    if not section:        return None    lowered = section.lower()    # Training is the highest-risk interpretation. Check it before generic    # headings such as "example" or "usage" so they cannot bypass training    # authorization when both appear in the same title.    if any(word in lowered for word in ["training", "train", "finetune", "fine-tune", "pretrain"]):        return "training"    if any(word in lowered for word in ["evaluation", "evaluate", "benchmark", "metrics", "validation"]) or re.search(        r"\b(?:test|tests|testing)\b", lowered    ):        return "evaluation"    if any(word in lowered for word in ["inference", "usage", "demo", "example", "text-to-image", "image-to-image", "transcribe"]):        return "inference"    return None
scripts/extract_commands.py:252来自代码打开原文件
def training_structure_evidence(script: Path) -> List[str]:    try:        content = script.read_text(encoding="utf-8", errors="replace")    except OSError:        return []    evidence: List[str] = []    score = 0    for label, pattern, weight in TRAINING_STRUCTURE_SIGNALS:        if pattern.search(content):            evidence.append(label)            score += weight    return evidence if score >= 4 else []
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。发现 1 项风险
中风险

不受信任的 README 命令可能直接进入复现建议

原文依据:5 处
发现了什么

提取器只根据命令外形和 Markdown 位置收集内容,没有检查删除文件、上传凭据、远程执行或其他危险 shell 行为。Skill 随后要求给出“最小可信复现建议”,因此恶意仓库可把危险命令伪装成文档化的 demo 或评估步骤,影响后续代理或用户的选择。

为什么需要注意

该 Skill 本身不会执行命令;但如果主编排器或用户把其清单或建议当作已审查结果并执行,可能造成文件破坏、凭据泄露或未授权网络操作。

该风险成立,但影响是误导计划或用户选择,而非本技能直接执行命令。技能要求从 README 提取命令并推荐复现目标;提取器只判断文本是否“像命令”,随后原样纳入清单,没有可见的危险 shell 行为审查。因此,恶意仓库可把危险命令包装成文档化步骤并影响建议。技能明确禁止安装、资产准备和实质执行,降低了即时损害;用户可要求作者把 README 视为不可信输入,在推荐前标记删除、上传、凭据访问、管道到 shell 等行为,并禁止下游自动执行。

SKILL.md:42来自说明文档打开原文件
- concise repo structure summary- documented command inventory- inferred candidate categories: inference, evaluation, training, other- minimum trustworthy reproduction recommendation- notable ambiguity or risk list
查看另外 4 个位置
scripts/extract_commands.py:177来自代码打开原文件
def looks_like_command(line: str) -> bool:    candidate = re.sub(r"^(?:\$|PS> )\s*", "", line.strip())    if not candidate or candidate.startswith("#"):        return False    if candidate.startswith(("python", "pip", "conda", "bash", "sh", "make", "docker")):        return True    if candidate.startswith(COMMAND_PREFIXES):        return True    if re.search(r"\s--[A-Za-z0-9_-]+", candidate):        return True    if re.search(r"\b(?:python|pip|conda|torchrun|deepspeed|accelerate|bash|sh)\b", candidate):        return True    if re.search(r"[\\/].+\.(?:py|sh|bat)", candidate):        return True    if candidate.startswith(("cd ", "ls ", "mkdir ", "wget ", "curl ", "git ")):        return True    return False
scripts/extract_commands.py:300来自代码打开原文件
        for line in lines:            if line not in seen:                commands.append(                    {                        "command": line,                        "category": classify(line, section),                        "kind": command_kind(line, section),                        "section": section,                        "source": "code_block",                        "needs_substitution": bool(PLACEHOLDER_RE.search(line)),                    }                )
SKILL.md:27来自说明文档打开原文件
- This skill scans and plans.- This skill is helper-tier and should usually be orchestrator-invoked.- It does not install environments.- It does not prepare large assets.- It does not execute substantive reproduction commands.- It does not decide high-risk patching.
agents/openai.yaml:3来自说明文档打开原文件
short_description: Rigor Intake helper for scanning a repo and recommending the smallest trustworthy reproduction target.default_prompt: Scan this repository, read the README and common project files, extract documented commands, classify inference evaluation and training paths, and recommend the smallest trustworthy reproduction target.
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

6 个说明模块

该 Skill 的声明用途是只扫描和规划:读取仓库结构及 README,提取命令并分类,但不安装环境、准备大型资产或执行复现实验。

查看原文
SKILL.md:27来自说明文档打开原文件
- This skill scans and plans.- This skill is helper-tier and should usually be orchestrator-invoked.- It does not install environments.- It does not prepare large assets.- It does not execute substantive reproduction commands.- It does not decide high-risk patching.

仓库扫描器枚举目标路径的顶层名称,检测常见项目文件和目录,并在结果中包含解析后的绝对仓库路径及 README 路径。所示代码没有网络发送或文件写入。

查看原文
scripts/scan_repo.py:48来自代码打开原文件
    top_level = sorted(item.name for item in root.iterdir())    detected_files = [name for name in KEY_FILES if (root / name).exists()]    detected_dirs = [name for name in SIGNAL_DIRS if (root / name).exists()]    readme = first_existing(root, ["README.md", "README"])
scripts/scan_repo.py:59来自代码打开原文件
    return {        "generated_at": datetime.now(timezone.utc).isoformat(),        "repo_path": str(root.resolve()),        "readme_path": str(readme.resolve()) if readme else None,        "detected_files": detected_files,        "detected_dirs": detected_dirs,        "structure": {            "top_level": top_level,            "top_level_file_count": sum(1 for item in root.iterdir() if item.is_file()),

命令提取器会读取用户指定的 README,并可能读取其中引用、位于 README 同一目录树内且不超过 512 KiB 的 Python 脚本,以寻找训练结构信号;路径解析包含防止通过相对路径或符号链接越出该目录树的检查。

查看原文
scripts/extract_commands.py:241来自代码打开原文件
        return None    root = readme_dir.resolve()    candidate = (root / matched.group("path")).resolve()    try:        candidate.relative_to(root)    except ValueError:        return None    if not candidate.is_file() or candidate.stat().st_size > 524_288:        return None    return candidate
scripts/extract_commands.py:362来自代码打开原文件
    readme_path = Path(args.readme)    text = readme_path.read_text(encoding="utf-8", errors="replace")    data = extract_commands(text, readme_path.parent)
从这里开始 · 工作说明SKILL.md
repo-intake-and-plan
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。

文件引用关系图

1 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用,不是运行顺序。点击节点可高亮相关连线,并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录5 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • scripts/extract_commands.py已纳入全文
  • scripts/scan_repo.py已纳入全文
  • references/repo-scan-rules.md已纳入全文
  • agents/openai.yaml已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明
  • agents/openai.yaml配套文件
  • references/repo-scan-rules.md配套文件
  • scripts/extract_commands.py脚本
  • scripts/scan_repo.py脚本

代码和说明中提到的操作

运行命令
scripts/extract_commands.py:27来自代码打开原文件
    "conda ",    "bash ",    "sh ",
scripts/extract_commands.py:181来自代码打开原文件
        return False    if candidate.startswith(("python", "pip", "conda", "bash", "sh", "make", "docker")):        return True
scripts/extract_commands.py:187来自代码打开原文件
        return True    if re.search(r"\b(?:python|pip|conda|torchrun|deepspeed|accelerate|bash|sh)\b", candidate):        return True
安装其他软件包
scripts/extract_commands.py:118来自代码打开原文件
SETUP_PREFIXES = (    "pip install",    "pip3 install",
scripts/extract_commands.py:119来自代码打开原文件
    "pip install",    "pip3 install",    "conda install",
scripts/extract_commands.py:124来自代码打开原文件
    "conda activate",    "python -m pip install",    "git clone",
连接外部网站
scripts/extract_commands.py:128来自代码打开原文件
)ASSET_PREFIXES = ("wget ", "curl ", "mkdir ", "tar ", "unzip ", "7z ", "aria2c ")
scripts/extract_commands.py:191来自代码打开原文件
        return True    if candidate.startswith(("cd ", "ls ", "mkdir ", "wget ", "curl ", "git ")):        return True
读取文件
scripts/extract_commands.py:254来自代码打开原文件
    try:        content = script.read_text(encoding="utf-8", errors="replace")    except OSError:
scripts/extract_commands.py:358来自代码打开原文件
    parser = argparse.ArgumentParser(description="Extract shell-like commands from a README.")    parser.add_argument("--readme", required=True, help="Path to the README file.")    parser.add_argument("--json", action="store_true", help="Emit JSON output.")
scripts/extract_commands.py:363来自代码打开原文件
    readme_path = Path(args.readme)    text = readme_path.read_text(encoding="utf-8", errors="replace")    data = extract_commands(text, readme_path.parent)
读取了多少行
582
文件校验值(用于核对版本)
080d2e1f9e1de5c2e1dd468908f8f7708ca4fa197edc02a3b285eae5a3566503