中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：1 天前 重新扫描
15 /100
inflynce-create-campaign
Create and launch Inflynce Boost campaigns to promote any https:// link by paying USDC rewards to real users on Base
This is a legitimate Inflynce marketing campaign creation tool with well-documented functionality, proper GraphQL URL validation, HTTPS enforcement, and clear marking of agent-created campaigns. The only notable risk is private key handling for blockchain transactions, which is explicitly documented and marked as highly sensitive.
技能名称inflynce-create-campaign
分析耗时43.8s
引擎pi
✓
可以安装
Approve for use. If possible, use the web interface at boost.inflynce.com for the 0.25 USDC fee payment to avoid storing a private key in the agent environment. Ensure PRIVATE_KEY is not logged or exposed in error messages.

安全发现 2 项

严重性 安全发现 位置
低危
PRIVATE_KEY required for blockchain transactions 凭证窃取
pay_fee.js and top_up.js require a wallet private key to sign real USDC transfers on Base. This is a legitimate requirement for the tool's functionality but introduces risk if the key is mishandled.
PRIVATE_KEY=0x... node scripts/pay_fee.js
→ Prefer manual payment via web UI to avoid storing private key in agent. If required, ensure the environment is secure and key is not logged.
 SKILL.md:55
低危
Dependencies use caret versioning 供应链
package.json uses ^2.0.0 versioning for viem and ethereum-cryptography, allowing minor/patch updates.
"viem": "^2.0.0"
→ Consider pinning exact versions for production environments to prevent unexpected updates.
 package.json:10
资源类型声明权限推断权限状态证据
网络访问 READ READ ✓ 一致 GraphQL POST to boost.inflynce.com, validated to exact host
环境变量 READ READ ✓ 一致 Reads GRAPHQL_URL, PRIVATE_KEY, RPC_URL from process.env
命令执行 NONE WRITE ✓ 一致 Test file uses spawnSync to run node scripts (acceptable test practice)
数据库 NONE WRITE ✓ 一致 Blockchain write operations via viem for USDC transfers - documented in SKILL.md
文件系统 NONE NONE — No direct filesystem access in scripts
17 项发现
🔗
中危 外部 URL 外部 URL
https://boost.inflynce.com/api/graphql
SKILL.md:6
🔗
中危 外部 URL 外部 URL
https://boost.inflynce.com
SKILL.md:8
🔗
中危 外部 URL 外部 URL
https://mainnet.base.org
SKILL.md:48
💰
中危 钱包地址 加密货币钱包地址
0xA61529732F4E71ef1586252dDC97202Ce198A38A
SKILL.md:63
💰
中危 钱包地址 加密货币钱包地址
0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
SKILL.md:64
💰
中危 钱包地址 加密货币钱包地址
0x6e6A6128bB0c175989066eb0e2bf54F06688207b
SKILL.md:65
🔗
中危 外部 URL 外部 URL
https://x.com/user/status/123
SKILL.md:88
🔗
中危 外部 URL 外部 URL
https://x.com/...
SKILL.md:123
🔗
中危 外部 URL 外部 URL
https://twitter.com/...
SKILL.md:123
🔗
中危 外部 URL 外部 URL
https://warpcast.com/~/casts/0x...
SKILL.md:125
🔗
中危 外部 URL 外部 URL
https://paulmillr.com/funding/
package-lock.json:30
💰
中危 钱包地址 加密货币钱包地址
0x0000000000000000000000000000000000000001
test/create_campaign.test.js:42
🔗
中危 外部 URL 外部 URL
https://warpcast.com/~/casts/$
test/create_campaign.test.js:69
🔗
中危 外部 URL 外部 URL
https://x.com/user/1
test/create_campaign.test.js:88
🔗
中危 外部 URL 外部 URL
https://evil.com/graphql
test/create_campaign.test.js:120
🔗
中危 外部 URL 外部 URL
http://boost.inflynce.com/api/graphql
test/create_campaign.test.js:132
🔗
中危 外部 URL 外部 URL
https://evil.boost.inflynce.com/api/graphql
test/create_campaign.test.js:156

目录结构

8 文件 · 39.8 KB · 1100 行
JavaScript 4f · 469L JSON 3f · 382L Markdown 1f · 249L
├─ ▾ 📁 scripts
│ ├─ 📜 create_campaign.js JavaScript 152L · 4.5 KB
│ ├─ 📜 pay_fee.js JavaScript 63L · 1.9 KB
│ └─ 📜 top_up.js JavaScript 68L · 2.0 KB
├─ ▾ 📁 test
│ └─ 📜 create_campaign.test.js JavaScript 186L · 6.3 KB
├─ 📋 clawhub.json JSON 13L · 681 B
├─ 📋 package-lock.json JSON 355L · 11.8 KB
├─ 📋 package.json JSON 14L · 544 B
└─ 📝 SKILL.md Markdown 249L · 12.1 KB

依赖分析 2 项

包名版本来源已知漏洞备注
viem ^2.0.0 (installed: 2.47.0) npm 否 Well-audited Ethereum library by wevm team
ethereum-cryptography ^2.0.0 (installed: 2.2.1) npm 否 Standard cryptography library for keccak256 hashing

安全亮点

✓ GraphQL URL is validated at runtime to exact hostname 'boost.inflynce.com'
✓ HTTPS protocol is enforced for all network requests
✓ Subdomain attacks are explicitly blocked (evil.boost.inflynce.com rejected)
✓ Payment hash format validation (0x + 64 hex chars)
✓ Budget minimum enforcement (5 USDC)
✓ Agent-created campaigns clearly marked with appType: 2
✓ Comprehensive security-focused test coverage for URL validation
✓ Uses reputable, well-audited libraries (viem, ethereum-cryptography)
✓ No sensitive file access (~/.ssh, ~/.aws, .env files not accessed)
✓ No obfuscation or encoded execution patterns detected
✓ No data exfiltration or C2 communication
✓ No credential harvesting beyond what's necessary
✓ No curl|bash remote execution patterns
✓ Documentation accurately describes all functionality