中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：18 小时前 重新扫描
15 /100
meeting-minutes-retriever
Read meeting minutes or notes from a local file path or URL, or inspect a local meeting-notes directory and report the file count plus file list.
A legitimate meeting minutes retriever skill that uses declared subprocess calls for directory listing and local file/URL reading with no malicious behavior detected.
技能名称meeting-minutes-retriever
分析耗时32.9s
引擎pi
✓
可以安装
Approve for use. Consider pinning the requests library version for supply chain hygiene.

安全发现 2 项

严重性 安全发现 位置
低危
Unpinned requests dependency 供应链
The read_meeting_data.py script imports requests but does not pin to a specific version. This could lead to unexpected behavior if a newer version introduces breaking changes or vulnerabilities.
import requests
→ Pin requests to a known-safe version (e.g., requests>=2.28.0) to ensure reproducible behavior.
 scripts/read_meeting_data.py:7
低危
SKILL.md frontmatter lacks explicit allowed-tools declaration 文档欺骗
The skill's YAML frontmatter does not declare allowed-tools, making it unclear which pi tools are authorized. However, the behavior described in the body is well-scoped.
---
name: meeting-minutes-retriever
...
→ Add an allowed-tools list to the frontmatter (e.g., Read, Bash, WebFetch) for clarity.
 SKILL.md:1
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 SKILL.md declares local file reading; read_meeting_data.py implements os.path.ab…
网络访问 READ READ ✓ 一致 SKILL.md declares URL fetching; read_meeting_data.py implements requests.get()
命令执行 WRITE WRITE ✓ 一致 SKILL.md declares OS-appropriate system commands; list_meeting_files.py uses sub…
环境变量 NONE NONE — No os.environ access observed
剪贴板 NONE NONE — No clipboard access
浏览器 NONE NONE — No browser automation
数据库 NONE NONE — No database access
技能调用 NONE NONE — No cross-skill invocation

目录结构

6 文件 · 10.9 KB · 271 行
Python 2f · 186L Markdown 1f · 79L YAML 1f · 4L Text 2f · 2L
├─ ▾ 📁 agents
│ └─ 📋 openai.yaml YAML 4L · 329 B
├─ ▾ 📁 scripts
│ ├─ 🐍 list_meeting_files.py Python 124L · 3.9 KB
│ └─ 🐍 read_meeting_data.py Python 62L · 2.2 KB
├─ 📄 sample_meeting_gbk.txt Text 1L · 112 B
├─ 📄 sample_meeting.txt Text 1L · 64 B
└─ 📝 SKILL.md Markdown 79L · 4.3 KB

依赖分析 1 项

包名版本来源已知漏洞备注
requests * pip 否 Version not pinned; import in scripts/read_meeting_data.py

安全亮点

✓ Subprocess calls are limited to OS-native file listing commands (find/PowerShell) with no arbitrary command execution
✓ File and URL reading returns data only to the caller, with no exfiltration
✓ No credential harvesting or sensitive path access detected
✓ No obfuscation, base64 encoding, or hidden instructions
✓ Multi-encoding fallback for local file reading is a good robustness practice
✓ Error messages are user-friendly and do not leak system internals
✓ Documentation accurately describes the tool's actual behavior with no mismatches
✓ Subprocess usage is declared in SKILL.md under the Tool Contract section