中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 0/100
上次扫描：2 天前 重新扫描
0 /100
Weibo, Baidu, Douyin Hot Search List
获取微博、百度、抖音等平台热搜榜单与链接等
Legitimate hot search aggregation skill that makes outbound API calls to jisuapi.com for Weibo/Baidu/Douyin trending data.
技能名称Weibo, Baidu, Douyin Hot Search List
分析耗时24.2s
引擎pi
✓
可以安装
No action needed. Consider pinning the requests library version in a requirements.txt for reproducibility.

安全发现 2 项

严重性 安全发现 位置
低危
requests library not version-pinned
The hotsearch.py uses the requests library without specifying a version constraint. A requirements.txt with 'requests>=2.28.0' would improve reproducibility.
import requests
→ Add requirements.txt with pinned dependencies
 hotsearch.py:11
提示
Placeholder API key in documentation
SKILL.md line 28 shows 'API_KEY="your_appkey_here"' as a usage example placeholder. This is documentation guidance, not an actual embedded credential.
export JISU_API_KEY="your_appkey_here"
→ This is a false positive from automated scanning - no action needed
 SKILL.md:28
资源类型声明权限推断权限状态证据
网络访问 READ READ ✓ 一致 hotsearch.py:36 - makes HTTPS GET to api.jisuapi.com
环境变量 READ READ ✓ 一致 hotsearch.py:81 - reads JISU_API_KEY
文件系统 NONE NONE — No file I/O operations
命令执行 NONE NONE — No subprocess or shell execution
1 高危 5 项发现
🔑
高危 API 密钥 疑似硬编码凭证
API_KEY="your_appkey_here"
SKILL.md:28
🔗
中危 外部 URL 外部 URL
https://www.jisuapi.com/
SKILL.md:9
🔗
中危 外部 URL 外部 URL
https://www.jisuapi.com/api/hotsearch/
SKILL.md:22
🔗
中危 外部 URL 外部 URL
https://s.weibo.com/weibo?q=...
SKILL.md:67
🔗
中危 外部 URL 外部 URL
https://api.jisuapi.com/hotsearch
hotsearch.py:14

目录结构

2 文件 · 7.0 KB · 213 行
Markdown 1f · 117L Python 1f · 96L
├─ 🐍 hotsearch.py Python 96L · 2.3 KB
└─ 📝 SKILL.md Markdown 117L · 4.7 KB

依赖分析 1 项

包名版本来源已知漏洞备注
requests * pip 否 Version not pinned

安全亮点

✓ No sensitive path access (~/.ssh, ~/.aws, .env files)
✓ No shell command execution or subprocess usage
✓ No data exfiltration or credential harvesting
✓ API key only used locally to authenticate with jisuapi.com
✓ No base64, eval, or obfuscated code patterns
✓ Clear, documented purpose with declared API dependency
✓ Simple, readable code with proper error handling