中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：22 小时前 重新扫描
5 /100
faceless-video
Scenario-focused Sparki skill for faceless or no-camera-presence video outputs
Legitimate video editing CLI tool with no malicious behavior detected. All functionality is declared, scoped, and performs standard API-based video processing.
技能名称faceless-video
分析耗时41.7s
引擎pi
✓
可以安装
This skill is safe to use. No security concerns requiring action.

安全发现 1 项

严重性 安全发现 位置
低危
Implicit config directory creation 权限提升
The skill auto-creates ~/.openclaw/config and ~/.openclaw/workspace/sparki/videos directories on first run. This is within declared scope but happens silently.
self.config_dir.mkdir(parents=True, exist_ok=True)
→ Document auto-creation behavior in SKILL.md for transparency
 src/sparki_cli/config.py:15
资源类型声明权限推断权限状态证据
文件系统 WRITE WRITE ✓ 一致 SKILL.md declares write to ~/.openclaw/config and ~/.openclaw/workspace/sparki/v…
网络访问 READ READ ✓ 一致 client.py only communicates with agent-api.sparki.io
环境变量 NONE READ ✓ 一致 config.py:17 reads SPARKI_API_KEY env var, only for auth purposes
命令执行 NONE NONE — No subprocess, os.system, or shell execution found
7 项发现
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/ClawHub-Skill-blueviolet
README.md:3
🔗
中危 外部 URL 外部 URL
https://clawhub.io
README.md:3
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/version-1.0.12-blue
README.md:4
🔗
中危 外部 URL 外部 URL
https://sparki.io
SKILL.md:17
🔗
中危 外部 URL 外部 URL
https://agent-api.sparki.io
src/sparki_cli/constants.py:61
🔗
中危 外部 URL 外部 URL
https://t.me/Sparki_AI_bot/upload
src/sparki_cli/constants.py:62
🔗
中危 外部 URL 外部 URL
https://sparki.io/pricing
src/sparki_cli/constants.py:101

目录结构

11 文件 · 33.3 KB · 1010 行
Python 7f · 904L Markdown 2f · 71L TOML 1f · 31L JSON 1f · 4L
├─ ▾ 📁 src
│ └─ ▾ 📁 sparki_cli
│ ├─ 🐍 __init__.py Python 3L · 81 B
│ ├─ 🐍 cli.py Python 507L · 17.1 KB
│ ├─ 🐍 client.py Python 99L · 4.0 KB
│ ├─ 🐍 config.py Python 55L · 1.9 KB
│ ├─ 🐍 constants.py Python 139L · 4.8 KB
│ ├─ 🐍 models.py Python 59L · 1.3 KB
│ └─ 🐍 output.py Python 42L · 1.0 KB
├─ 📋 _meta.json JSON 4L · 54 B
├─ 📄 pyproject.toml TOML 31L · 579 B
├─ 📝 README.md Markdown 28L · 964 B
└─ 📝 SKILL.md Markdown 43L · 1.5 KB

依赖分析 3 项

包名版本来源已知漏洞备注
typer >=0.9.0 pip 否 Version pinned to major version
httpx >=0.27.0 pip 否 Version pinned to major version
pydantic >=2.0.0 pip 否 Version pinned to major version

安全亮点

✓ No shell execution (subprocess, os.system) detected in any file
✓ No credential harvesting - API key used only for Sparki API authentication
✓ No data exfiltration - all network traffic goes to declared agent-api.sparki.io domain only
✓ No obfuscation (base64, eval, atob) found in codebase
✓ Documentation accurately reflects code behavior - no doc-to-code mismatch
✓ No hidden functionality discovered
✓ No supply chain risks - dependencies from PyPI with version constraints
✓ No persistence mechanisms (cron, startup hooks, backdoors) found
✓ No sensitive path access outside declared config/output directories
✓ Clean code architecture with separation of concerns (CLI, client, config, models, output)