中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：2 天前 重新扫描
15 /100
A股财务分析
通过调用Prana平台上的远程agent完成A股上市公司财务状况分析，从6个维度展示，生成交互式HTML报告
A legitimate A-share financial analysis skill with thin, transparent client scripts that properly declare all network calls and environment variable usage, featuring strong user-confirmation guardrails.
技能名称A股财务分析
分析耗时31.9s
引擎pi
✓
可以安装
This skill is safe to use. No malicious patterns detected. The extensive documentation could be simplified but represents best-practice user protection rather than a security risk.

安全发现 1 项

严重性 安全发现 位置
低危
Overly verbose documentation with minor clarity issues
SKILL.md is 223 lines with repeated 'Confirmation Required: NO/YES' flags and nearly identical rules restated multiple times. The rules around Step 2 subprocess/curl usage are documented (correctly labeled as NO/SHELL:WRITE), but the sheer length may obscure important distinctions. No security impact, but reduces auditability.
Step 2 硬性要求（无论上下文如何均适用）...
→ Consider condensing repetitive process rules while preserving the critical security guardrails (user confirmation before API key fetch, no key overwriting without permission).
 SKILL.md:1
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No file system access in any script
网络访问 READ/WRITE READ/WRITE ✓ 一致 POST to claw-uat.ebonex.io declared in SKILL.md and skill.json
命令执行 WRITE WRITE ✓ 一致 env|grep and curl documented in SKILL.md; scripts do not execute shell
环境变量 READ READ ✓ 一致 PRANA_SKILL_API_FLAG read declared in skill.json and SKILL.md
技能调用 WRITE WRITE ✓ 一致 POST /api/claw/agent-run invokes remote skill
剪贴板 NONE NONE — No clipboard access
浏览器 NONE NONE — No browser access
数据库 NONE NONE — No database access
7 项发现
🔗
中危 外部 URL 外部 URL
https://claw-uat.ebonex.io/api/v2/api-keys
SKILL.md:15
🔗
中危 外部 URL 外部 URL
https://claw-uat.ebonex.io/api/claw/agent-run
SKILL.md:17
🔗
中危 外部 URL 外部 URL
https://claw-uat.ebonex.io/api/claw/agent-result
SKILL.md:19
🔗
中危 外部 URL 外部 URL
https://claw-uat.ebonex.io/api/claw/skill-purchase-history-url
SKILL.md:21
🔗
中危 外部 URL 外部 URL
https://claw-uat.ebonex.io/skill-purchase-history-url?pay_token=xxxxxxx
SKILL.md:199
🔗
中危 外部 URL 外部 URL
https://claw-uat.ebonex.io
SKILL.md:218
🔗
中危 外部 URL 外部 URL
https://claw-uat.ebonex.io/
SKILL.md:221

目录结构

4 文件 · 28.8 KB · 604 行
Markdown 1f · 223L JavaScript 1f · 163L Python 1f · 163L JSON 1f · 55L
├─ ▾ 📁 scripts
│ ├─ 📜 prana_skill_client.js JavaScript 163L · 5.1 KB
│ └─ 🐍 prana_skill_client.py Python 163L · 5.7 KB
├─ 📋 skill.json JSON 55L · 2.0 KB
└─ 📝 SKILL.md Markdown 223L · 15.9 KB

安全亮点

✓ All network requests go to a single, clearly declared domain: claw-uat.ebonex.io
✓ No base64, eval, or obfuscated code in either client script
✓ API key is read from environment variable only; never hardcoded or logged
✓ Strong user-confirmation gate before fetching API keys (Step 2 requires explicit user consent)
✓ Scripts are thin wrappers (~163 lines each) with straightforward, auditable logic
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env, etc.)
✓ No credential exfiltration or data theft patterns
✓ No remote script execution (curl|bash, wget|sh)
✓ skill.json and SKILL.md declare all network requests and environment variables
✓ No subprocess, os.system, or shell=True usage in client scripts
✓ Both Node.js and Python clients are functionally identical and independently verifiable