中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 18/100
Last scan:18 hr ago Rescan
18 /100
szzg007-product-promotion
E-commerce product promotion email generation skill - extracts images from product URLs, generates HTML email templates, and saves to asset library with optional email sending.
This is a legitimate e-commerce product promotion email generation skill with declared image extraction, template generation, and email sending capabilities. The only notable concern is a hardcoded SMTP credential in the source code, which is a deployment hygiene issue rather than malicious behavior.
Skill Nameszzg007-product-promotion
Duration47.2s
Enginepi
✓
Safe to install
Remove hardcoded SMTP credentials from send-email.py and load from environment variables or config file instead. No other security concerns require blocking the skill's use.

Findings 3 items

Severity Finding Location
Medium
Hardcoded SMTP credential in source code Credential Theft
SMTP password 'FC27pgp77tc5Vvhv' is hardcoded as a string constant in send-email.py line 20. This is a deployment hygiene issue. The credential is not exfiltrated but could be extracted from the source code. SKILL.md references an email-config.env file that should store this, but the actual script bypasses it.
SMTP_PASS = "FC27pgp77tc5Vvhv"
→ Remove hardcoded credentials. Load SMTP_PASS from environment variable or the email-config.env file referenced in SKILL.md.
 scripts/send-email.py:20
Low
Subprocess curl execution not declared in capability model Doc Mismatch
SKILL.md states '使用 curl 下载' for image extraction, but the capability map does not declare shell:WRITE. The skill uses subprocess.run(['curl', ...]) in product-promotion.py line 128 for downloading images. This is a legitimate and necessary operation for the feature, but not formally declared.
subprocess.run(['curl', '-L', '-sS', '-o', str(filepath), url], capture_output=True, timeout=30)
→ Declare shell:WRITE capability in SKILL.md since curl download via subprocess is used.
 scripts/product-promotion.py:128
Low
No pinned Python dependencies Supply Chain
package.json declares 'dependencies': {} and engines python>=3.8 with no requirements.txt or pinned packages. While the scripts use only built-in libraries (sys, json, smtplib, ssl, pathlib, subprocess, etc.), dependency pinning would improve supply chain hygiene.
"dependencies": {}
→ Add a requirements.txt with pinned versions of any future dependencies.
 package.json:41
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned SKILL.md: Saves to product-promotion-assets/emails/ and images/
Network READ READ ✓ Aligned SKILL.md: Extracts images via browser/curl from product URLs; sends via SMTP
Shell NONE WRITE ✓ Aligned product-promotion.py:128 - subprocess.run(['curl', ...]) not declared in SKILL.m…
Environment NONE NONE — No environment variable access detected
Skill Invoke NONE NONE — No cross-skill invocation detected
Clipboard NONE NONE — No clipboard access detected
Browser READ READ ✓ Aligned SKILL.md: browser tool for snapshot image extraction
Database NONE NONE — No database access detected
17 findings
🔗
Medium External URL 外部 URL
https://www.themossriver.com/products/clear-pc-storage-box
README.md:72
🔗
Medium External URL 外部 URL
https://www.example.com/product/xxx
SKILL.md:27
🔗
Medium External URL 外部 URL
https://xxx.com/product/123
SKILL.md:33
🔗
Medium External URL 外部 URL
https://xxx.com/product/123，生成邮件模版，保存到素材库
SKILL.md:39
🔗
Medium External URL 外部 URL
https://xxx.com/product/456
SKILL.md:43
🔗
Medium External URL 外部 URL
https://shop.example.com/product/premium-organizer
SKILL.md:161
🔗
Medium External URL 外部 URL
https://www.themossriver.com/products/storage-box
references/CODE_SYSTEM.md:160
🔗
Medium External URL 外部 URL
https://shop.example.com/kids-summer-dress
references/CODE_SYSTEM.md:168
🔗
Medium External URL 外部 URL
https://shop.com/product/1
references/USAGE_EXAMPLES.md:71
🔗
Medium External URL 外部 URL
https://shop.com/product/2
references/USAGE_EXAMPLES.md:72
🔗
Medium External URL 外部 URL
https://shop.com/product/3
references/USAGE_EXAMPLES.md:73
🔗
Medium External URL 外部 URL
https://shop.com/product/4
references/USAGE_EXAMPLES.md:74
🔗
Medium External URL 外部 URL
https://shop.com/product/5
references/USAGE_EXAMPLES.md:75
🔗
Medium External URL 外部 URL
https://shop.com/product/blue-widget
references/USAGE_EXAMPLES.md:104
📧
Info Email 邮箱地址
[email protected]
README.md:63
📧
Info Email 邮箱地址
[email protected]
SKILL.md:49
📧
Info Email 邮箱地址
[email protected]
scripts/send-email.py:20

File Tree

9 files · 55.9 KB · 1887 lines
Python 3f · 897L Markdown 4f · 739L HTML 1f · 180L JSON 1f · 71L
├─ ▾ 📁 references
│ ├─ 📝 CODE_SYSTEM.md Markdown 231L · 5.3 KB
│ └─ 📝 USAGE_EXAMPLES.md Markdown 186L · 4.0 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 email-code-manager.py Python 224L · 6.6 KB
│ ├─ 🐍 product-promotion.py Python 563L · 19.0 KB
│ └─ 🐍 send-email.py Python 110L · 2.9 KB
├─ ▾ 📁 templates
│ └─ 📄 email-template-v1.html HTML 180L · 8.1 KB
├─ 📋 package.json JSON 71L · 1.9 KB
├─ 📝 README.md Markdown 92L · 2.3 KB
└─ 📝 SKILL.md Markdown 230L · 5.8 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
None (uses only built-in Python libraries) N/A stdlib No No third-party dependencies

Security Positives

✓ No base64-encoded execution, eval(), or obfuscated code detected
✓ No credential harvesting from environment or sensitive paths (~/.ssh, ~/.aws, .env)
✓ No reverse shell, C2 communication, or data exfiltration endpoints
✓ No hidden instructions in HTML comments or templates
✓ No curl|bash remote script execution
✓ No access to sensitive user paths (SSH keys, cloud credentials)
✓ No cron, persistence, or backdoor mechanisms
✓ SMTP credential is used locally for the stated feature (email sending), not exfiltrated
✓ All file I/O is confined to declared output directories within the skill's asset paths