中文 EN

扫描报告

扫描新文件

⚠ 可疑 — 风险评分 45/100
上次扫描：2 天前 重新扫描
45 /100
self-evolution-engine
自我进化引擎 - AI Skill自我分析、自我改进、自我学习能力
Skill contains a hardcoded API key for billing integration that is not properly declared in documentation, representing undeclared credential handling with potential for unauthorized charges.
技能名称self-evolution-engine
分析耗时39.4s
引擎pi
⚠
谨慎使用
Replace hardcoded API key with environment variable reference (SKILLPAY_API_KEY). Add clear documentation about billing integration and network API calls in SKILL.md.

攻击链 2 步

⬡
提权 Attacker examines skill and extracts hardcoded API key from payment.py
payment.py:12
◉
影响 Attacker uses extracted API key to make unauthorized charges to skillpay.me billing API
payment.py:44

安全发现 4 项

严重性 安全发现 位置
高危
Hardcoded API Key
A production API key for skillpay.me billing service is hardcoded in payment.py source file. This key could be extracted and used for unauthorized billing charges.
BILLING_API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2"
→ Replace with environment variable: BILLING_API_KEY = os.environ.get('SKILLPAY_API_KEY', '')
 payment.py:12
中危
Undeclared Network Communication
SKILL.md does not mention that the skill makes network requests to an external billing API (skillpay.me). This constitutes hidden functionality.
SkillPay mentioned but no mention of network calls or credential usage
→ Add a 'Network Usage' section documenting external API calls for billing
 SKILL.md:1
低危
Credential Stored in Version Control
If this repository is committed to version control, the hardcoded API key could be exposed in history.
BILLING_API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2"
→ Use environment variables and add payment.py to .gitignore or remove before committing
 payment.py:12
提示
Billing Logic Auto-execution
The payment verification (require_payment()) could automatically charge users on every skill invocation if imported and called.
if __name__ == '__main__': require_payment()
→ Ensure billing is only triggered when explicitly requested by user
 payment.py:67
资源类型声明权限推断权限状态证据
文件系统 NONE WRITE ✓ 一致 Used for logs, backups, snapshots, evolution patches - declared in feature set
网络访问 NONE READ ✗ 越权 payment.py:25-67 makes requests to skillpay.me API with API key - not declared i…
命令执行 NONE NONE — No subprocess or shell execution detected
环境变量 NONE READ ✓ 一致 Reads SKILLPAY_USER_ID from environment for billing - legitimate use case
1 高危 2 项发现
🔑
高危 API 密钥 疑似硬编码凭证
API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2"
payment.py:12
🔗
中危 外部 URL 外部 URL
https://skillpay.me
payment.py:11

目录结构

9 文件 · 56.0 KB · 1662 行
Python 5f · 1300L Markdown 2f · 329L JSON 1f · 19L Text 1f · 14L
├─ ▾ 📁 references
│ └─ 📝 architecture.md Markdown 245L · 6.7 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 error_analyzer.py Python 281L · 9.6 KB
│ ├─ 🐍 evolution_generator.py Python 394L · 13.6 KB
│ ├─ 🐍 performance_monitor.py Python 200L · 6.9 KB
│ └─ 🐍 version_manager.py Python 283L · 10.2 KB
├─ 📋 _meta.json JSON 19L · 442 B
├─ 🐍 payment.py Python 142L · 5.2 KB
├─ 📄 requirements.txt Text 14L · 217 B
└─ 📝 SKILL.md Markdown 84L · 3.1 KB

依赖分析 5 项

包名版本来源已知漏洞备注
requests * pip 否 Standard HTTP library, no specific vulnerabilities
python-dateutil >=2.8.0 pip 否 Version pinned
pandas >=2.0.0 pip 否 Optional dependency for advanced analysis
psutil >=5.9.0 pip 否 Optional dependency for monitoring
matplotlib >=3.7.0 pip 否 Optional dependency for reporting

安全亮点

✓ No shell/subprocess execution detected - legitimate Python-only implementation
✓ No sensitive path access (no ~/.ssh, ~/.aws, .env file reading for theft)
✓ No base64 encoded commands or obfuscated payloads
✓ No data exfiltration mechanisms detected
✓ Version management includes backup/restore with human approval for changes
✓ Evolution system requires --confirm flag for applying patches
✓ No eval() or dangerous code execution patterns