
Security News
Open VSX Begins Implementing Pre-Publish Security Checks After Repeated Supply Chain Incidents
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.
trpc.group/trpc-go/trpc-agent-go/examples/skill
Advanced tools
This example runs a small GAIA benchmark dataset using trpc-agent-go,
including tasks that require:
whisper skill)ocr skill)-data-dir)The goal is to show how to combine:
skill_load / skill_run (run scripts inside an isolated workspace)-data-dir)workspace://... references to pass skill outputs across toolsmain.go)./data/ placeholder (gitignored) for GAIA JSON/files./skills (whisper, ocr)OPENAI_API_KEY must be setOPENAI_BASE_URL is optional (set it when not using OpenAI)skill_run executes scripts with python3 from your PATH. Install
dependencies into the same Python environment that python3 points to.
venv:
cd examples/skill
python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install -U pip
conda:
conda create -n trpc-skill python=3.11
conda activate trpc-skill
python3 -m pip install -U pip
python3 -m pip install openai-whisper pillow pytesseract
whisper needs ffmpegocr needs the tesseract binaryCommon installs:
brew install ffmpeg tesseractsudo apt-get install ffmpeg tesseract-ocrwhich python3
python3 -c "import whisper; print('whisper ok')"
python3 -c "import pytesseract; from PIL import Image; print('ocr ok')"
ffmpeg -version | head -n 1
tesseract --version | head -n 1
See the skill docs:
skills/whisper/SKILL.mdskills/ocr/SKILL.mdThis example expects (you need to download/populate these files locally):
./data/gaia_2023_level1_validation.json./data/2023/validation/*./data is intentionally gitignored, so you can put benchmark data
there without accidentally committing it.
Quick sanity check after you prepare the data:
cd examples/skill
ls -la data/gaia_2023_level1_validation.json
ls -la data/2023/validation | head
GAIA is gated on Hugging Face. To download it, you must request access and create a Hugging Face access token.
The script checks HF_TOKEN, HUGGINGFACE_TOKEN, and
HUGGINGFACE_HUB_TOKEN.
The downloader uses only the Python standard library (no extra pip packages needed).
From the repo root:
export HF_TOKEN="hf_..."
python3 examples/skill/scripts/download_gaia_2023_level1_validation.py
Or from examples/skill:
cd examples/skill
export HF_TOKEN="hf_..."
python3 scripts/download_gaia_2023_level1_validation.py
This downloads only the JSON metadata file by default:
examples/skill/data/gaia_2023_level1_validation.jsonTo also download attachment files referenced by file_path, run:
python3 scripts/download_gaia_2023_level1_validation.py --with-files
Attachments are saved under examples/skill/data/ (for example,
examples/skill/data/2023/validation/*.mp3).
From the repo root:
cd examples/skill
export OPENAI_API_KEY="your-key"
export OPENAI_BASE_URL="https://your-openai-compatible-endpoint/v1"
go run . \
-data-dir ./data \
-dataset ./data/gaia_2023_level1_validation.json \
-model "your-model-name" \
-task-id 31
Notes:
-task-id accepts either a task UUID or a 1-based index (e.g. 31).../results/trpc-agent-go.json by default../skill_workspaces/ (safe to delete).skill_run executes in an isolated workspace. Files written there are not
automatically visible to normal file tools unless they are exported.
Recommended patterns:
skill_run, write outputs under out/ and set
output_files so the tool returns text file contents inline.
Non-text files (like images) are returned as metadata only.output_files[*].ref
(a workspace://... reference), not a host filesystem path.FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.

Research
/Security News
Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.

Security News
Lodash 4.17.23 marks a security reset, with maintainers rebuilding governance and infrastructure to support long-term, sustainable maintenance.