扫描报告
0 /100
auto-iteration
安全的自动任务迭代和优化系统
Clean, self-contained iteration agent using only Python standard library with proper tool whitelisting, sandboxed eval, and no undeclared sensitive behavior.
可以安装
No action needed. The skill is safe to use.
| 资源类型 | 声明权限 | 推断权限 | 状态 | 证据 |
|---|---|---|---|---|
| 文件系统 | READ,WRITE | READ,WRITE | ✓ 一致 | _tool_read and _tool_write implemented with safety checks (size limit, path rest… |
| 命令执行 | NONE | NONE | — | No shell/subprocess calls in code; SecurityValidator blocks dangerous operations |
| 网络访问 | NONE | NONE | — | No network calls; _tool_search returns static mock data |
| 环境变量 | NONE | NONE | — | No os.environ access; only Path.home() used for local DB path |
| 数据库 | NONE | WRITE | ✓ 一致 | Creates/updates ~/.ai_iteration_log.db SQLite database for task logs; minor sinc… |
目录结构
4 文件 · 20.2 KB · 717 行 Python 1f · 511L
Markdown 1f · 163L
Shell 1f · 35L
Text 1f · 8L
├─
install.sh
Shell
├─
iteration_agent.py
Python
├─
requirements.txt
Text
└─
SKILL.md
Markdown
安全亮点
✓ Only uses Python standard library — no external dependencies or supply chain risk
✓ Tool whitelist enforced: only search, read, write, calculate, validate, analyze are allowed
✓ eval() sandboxed with empty __builtins__ dict and regex input validation (digits, whitespace, basic operators only)
✓ File write restricted to current working directory via is_relative_to check
✓ File read has 1MB size limit and 1KB output truncation
✓ Dangerous operations blacklist present (rm -rf, drop table, shutdown, etc.)
✓ No credential harvesting, no environment variable iteration, no sensitive path access (~/.ssh, ~/.aws, .env)
✓ No network requests, no external IP connections, no data exfiltration
✓ No obfuscation, no base64 execution, no curl|bash patterns
✓ No persistence mechanisms (no cron, no startup hooks)
✓ Install script is minimal and transparent (only creates run.sh launcher)