中文 EN

Scan Report

Scan New Files

⚠ Suspicious — Risk Score 48/100
Last scan:2 days ago Rescan
48 /100
PathClaw
华银康集团病理切片泛癌预测工具
Medical pathology diagnosis skill with hardcoded external IP address, shell execution via curl not explicitly declared, and user file upload to an unverified remote server.
Skill NamePathClaw
Duration28.8s
Enginepi
⚠
Use with caution
Replace hardcoded IP with domain name and TLS verification. Add explicit documentation about shell/curl usage and data handling policies for medical images.

Findings 4 items

Severity Finding Location
High
Hardcoded External IP Address
The skill connects to a hardcoded IP address (119.91.47.20) instead of a domain name. This prevents SSL certificate verification and server identity validation, making the skill vulnerable to man-in-the-middle attacks.
针对服务器 `http://119.91.47.20:8111/`
→ Replace with a proper domain name with valid TLS certificate
 SKILL.md:7
Medium
Undeclared Shell Execution
The skill documents curl commands which require shell:WRITE execution, but the SKILL.md does not explicitly declare this capability requirement.
curl -X POST http://119.91.47.20:8111/api/user/login
→ Document shell:WRITE as required capability in SKILL.md header
 SKILL.md:15
Medium
Medical Image Upload to External Server
User-provided pathology slide images (.svs files) are uploaded to an external IP without documented data handling, retention, or privacy policies.
-F "slide_file=@/path/to/slide_file"
→ Add data handling documentation and ensure compliance with medical data privacy requirements
 SKILL.md:35
Low
No SSL/TLS Verification Documentation
The skill does not document whether SSL certificate verification is performed on API connections.
http://119.91.47.20:8111/
→ Use HTTPS and document TLS verification behavior
 SKILL.md:7
ResourceDeclaredInferredStatusEvidence
Network READ READ ✓ Aligned SKILL.md describes API calls to external server
Shell NONE WRITE ✗ Violation SKILL.md:15-50 - curl commands require shell execution
1 High 5 findings
📡
High IP Address 硬编码 IP 地址
119.91.47.20
SKILL.md:7
🔗
Medium External URL 外部 URL
http://119.91.47.20:8111/
SKILL.md:7
🔗
Medium External URL 外部 URL
http://119.91.47.20:8111/api/user/login
SKILL.md:22
🔗
Medium External URL 外部 URL
http://119.91.47.20:8111/api/v1/diagnosis/run
SKILL.md:44
🔗
Medium External URL 外部 URL
http://119.91.47.20:8111/api/v1/diagnosis/
SKILL.md:56

File Tree

1 files · 4.9 KB · 115 lines
Markdown 1f · 115L
└─ 📝 SKILL.md Markdown 115L · 4.9 KB

Security Positives

✓ Comprehensive error handling documented (retry with exponential backoff)
✓ Token masking requirements documented for security
✓ File format validation before upload
✓ Clear status code handling documented
✓ No base64-encoded payloads or obfuscated code found