中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 20/100
上次扫描：19 小时前 重新扫描
20 /100
email-163-com
163 邮箱完整邮件管理工具 — Send/receive/search/manage emails via IMAP/SMTP
A legitimate 163 email client with documented installation methods involving curl|bash, but no malicious behavior found in the core skill implementation (main.py). The shell execution risk is limited to distribution documentation, not the skill itself.
技能名称email-163-com
分析耗时43.8s
引擎pi
✓
可以安装
Approve with caveats: (1) Replace placeholder URL in install.sh with a real, trusted endpoint before distribution; (2) Consider adding version pinning if external packages are ever added; (3) The curl|bash pattern is documented and visible in DISTRIBUTION.md, not hidden.

安全发现 3 项

严重性 安全发现 位置
中危
curl|bash documented as distribution method 文档欺骗
DISTRIBUTION.md:62 and install.sh:3 contain the pattern 'curl -L <URL> | bash' which is a well-known high-risk installation pattern. However, in this context it is documented as a user-facing distribution method (not hidden skill behavior), and the URL is a clearly marked placeholder 'your-server.com' rather than an active attacker-controlled endpoint.
curl -L https://your-server.com/email-163-com/install.sh | bash
→ Replace with a more secure distribution method such as direct git clone or signed package downloads.
 DISTRIBUTION.md:62
低危
Placeholder URL in install.sh 文档欺骗
install.sh:8 uses 'https://your-server.com/email-163-com.tar.gz' as a placeholder. While clearly a template, if this were published without replacement it would point to a non-existent or attacker-controlled server.
SKILL_URL="https://your-server.com/email-163-com.tar.gz"
→ Replace with a real, trusted hosting URL before distribution.
 install.sh:8
低危
Config stores plaintext credentials 敏感访问
The tool stores the 163 authorization code in plaintext in ~/.config/email-163-com/config.json. SKILL.md advises chmod 600 but the skill itself only sets this permission after save_config is called.
save_config() sets os.chmod(CONFIG_PATH, 0o600)
→ Consider supporting environment variables as the primary credential mechanism, or document that the file must be manually secured.
 SKILL.md:68
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 Reads ~/.config/email-163-com/config.json, writes to output_dir for attachments
网络访问 READ READ ✓ 一致 IMAP/SMTP connections only to imap.163.com:993 and smtp.163.com:465
命令执行 NONE NONE — main.py uses no subprocess — only smtplib/imaplib from stdlib
环境变量 READ READ ✓ 一致 Reads EMAIL_163_USER / EMAIL_163_PASS env vars per SKILL.md documented interface
2 严重 14 项发现
💀
严重 危险命令 危险 Shell 命令
curl -L https://your-server.com/email-163-com/install.sh | bash
DISTRIBUTION.md:62
💀
严重 危险命令 危险 Shell 命令
curl -L <URL> | bash
install.sh:3
🔗
中危 外部 URL 外部 URL
https://your-server.com/email-163-com/install.sh
DISTRIBUTION.md:62
🔗
中危 外部 URL 外部 URL
https://clawhub.cn
DISTRIBUTION.md:76
🔗
中危 外部 URL 外部 URL
https://clawhub.com/skills/email-163-com
PUBLIC-TEST-REPORT.md:486
🔗
中危 外部 URL 外部 URL
https://clawhub.ai/cli/auth
PUBLISH.md:78
🔗
中危 外部 URL 外部 URL
https://mail.163.com/
README-PACKAGE.md:52
🔗
中危 外部 URL 外部 URL
https://help.mail.163.com/
SKILL.md:327
🔗
中危 外部 URL 外部 URL
https://your-server.com/email-163-com.tar.gz
install.sh:8
🔗
中危 外部 URL 外部 URL
https://mail.163.com
main.py:119
📧
提示 邮箱 邮箱地址
[email protected]
INSTALL.md:108
📧
提示 邮箱 邮箱地址
[email protected]
PUBLIC-TEST-REPORT.md:467
📧
提示 邮箱 邮箱地址
[email protected]
main.py:186
📧
提示 邮箱 邮箱地址
[email protected]
main.py:805

目录结构

16 文件 · 91.0 KB · 3874 行
Markdown 10f · 2846L Python 1f · 899L JSON 4f · 77L Shell 1f · 52L
├─ 📋 _meta.json JSON 5L · 132 B
├─ 📝 DISTRIBUTION.md Markdown 283L · 5.7 KB
├─ 📋 evomap-capsule.json JSON 12L · 558 B
├─ 📋 evomap-gene.json JSON 7L · 282 B
├─ 📝 INSTALL.md Markdown 172L · 3.4 KB
├─ 🔧 install.sh Shell 52L · 1.3 KB
├─ 🐍 main.py Python 899L · 31.8 KB
├─ 📋 package.json JSON 53L · 1.1 KB
├─ 📝 PUBLIC-TEST-REPORT.md Markdown 539L · 10.2 KB
├─ 📝 PUBLISH.md Markdown 239L · 4.8 KB
├─ 📝 README-PACKAGE.md Markdown 145L · 2.3 KB
├─ 📝 README.md Markdown 202L · 3.7 KB
├─ 📝 RELEASE.md Markdown 289L · 5.8 KB
├─ 📝 SKILL.md Markdown 355L · 6.4 KB
├─ 📝 TEST-REPORT-v1.0.3.md Markdown 294L · 7.4 KB
└─ 📝 TEST-REPORT.md Markdown 328L · 6.1 KB

依赖分析 1 项

包名版本来源已知漏洞备注
None (stdlib only) N/A Python standard library 否 Uses only smtplib, imaplib, email — all from Python stdlib

安全亮点

✓ main.py uses only Python standard library (imaplib, smtplib, email) — no third-party dependencies
✓ No subprocess, os.system, or shell execution in the core skill code
✓ No base64 encoding/decoding or obfuscation
✓ No access to sensitive paths like ~/.ssh, ~/.aws, or .env
✓ No credential harvesting or data exfiltration — credentials are used only for legitimate IMAP/SMTP auth
✓ Network connections are limited to imap.163.com:993 and smtp.163.com:465 (declared in config)
✓ No hidden functionality — all features are documented in SKILL.md
✓ No cron/scheduled tasks or persistence mechanisms
✓ No supply chain risk — no dependencies in requirements.txt or package.json that could introduce vulnerabilities
✓ Config file permissions (0o600) are set during save_config()