中文 EN

扫描报告

扫描新文件

✓ 低风险 — 风险评分 5/100
上次扫描：21 小时前 重新扫描
5 /100
readme-maker
Design beautiful GitHub profile READMEs with templates. CLI for checking, validating, generating, and formatting README files and documentation.
readme-maker is a straightforward bash-based README CLI with purely local file logging — no network calls, credential access, obfuscation, or external dependencies.
技能名称readme-maker
分析耗时31.0s
引擎pi
✓
可以安装
No blocking action needed. The skill is safe for use as described.

安全发现 1 项

严重性 安全发现 位置
低危
Logging behavior is mentioned but not detailed in SKILL.md 文档欺骗
SKILL.md states 'persistent local logging' in the command description but does not enumerate the log files or the pipe-delimited storage format. This is a minor documentation gap with no security impact.
All from the command line with persistent local logging
→ Consider adding a 'Data Storage' section that details the log file names and format, as documented in the script's DATA_DIR behavior.
 SKILL.md:1
资源类型声明权限推断权限状态证据
命令执行 WRITE WRITE ✓ 一致 Bash shebang, set -euo pipefail, date/wc/du/tail/grep/sed/cat commands — all app…
文件系统 READ+WRITE WRITE ✓ 一致 Writes exclusively to ~/.local/share/readme-maker/ for logging; no sensitive pat…
网络访问 NONE NONE — Zero network calls in script.sh.
环境变量 NONE NONE — No access to os.environ or environment variables beyond HOME.
凭据 NONE NONE — No credential paths (~/.ssh, ~/.aws, .env) accessed.
1 项发现
📧
提示 邮箱 邮箱地址
[email protected]
SKILL.md:112

目录结构

2 文件 · 15.4 KB · 425 行
Shell 1f · 313L Markdown 1f · 112L
├─ ▾ 📁 scripts
│ └─ 🔧 script.sh Shell 313L · 11.0 KB
└─ 📝 SKILL.md Markdown 112L · 4.4 KB

安全亮点

✓ No network requests — zero outbound connectivity
✓ No credential or sensitive path access (~/.ssh, ~/.aws, .env, etc.)
✓ No obfuscation (no base64, eval, atob, or encoded payloads)
✓ No external dependencies or API calls
✓ Uses strict bash mode (set -euo pipefail)
✓ All file I/O is confined to a dedicated user-local directory (~/.local/share/readme-maker/)
✓ No remote script execution (curl|bash, wget|sh, etc.)
✓ No supply-chain risk — pure standard Unix utilities only
✓ Script content is clear, readable, and auditable