中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:2 days ago Rescan
5 /100
content-workflow-engine
Automate end-to-end content workflows from ideation to publication and distribution
This is a legitimate content workflow automation skill with no malicious behavior detected. All functionality is accurately documented, scripts use standard Python libraries, and no hidden exfiltration or credential harvesting was found.
Skill Namecontent-workflow-engine
Duration33.9s
Enginepi
✓
Safe to install
This skill is safe to use. Follow standard security practices: never commit api_config.json with real credentials, use environment variables for API keys in production, and rotate keys regularly.

Findings 3 items

Severity Finding Location
Low
Configuration template contains credential placeholders
The api_config.example.json file contains template fields for API keys and credentials. These are placeholders, not actual secrets, but could be mistakenly replaced with real values.
"api_key": "YOUR_OPENAI_API_KEY"
→ Ensure users understand these are examples only. Document the security note about using environment variables in production.
 assets/config/api_config.example.json:1
Info
subprocess usage for script execution
The blog_automated.py script uses subprocess.run() to execute workflows. This is expected and documented behavior for a CLI-based workflow tool.
subprocess.run(["python3", "run_workflow.py", ...])
→ No action needed - this is legitimate CLI tool behavior
 scripts/workflow_templates/blog_automated.py:195
Info
File system operations scoped to specific directories
All file write operations are scoped to controlled directories: workflows/, reports/, brainstorm_output/, and backups/. No access to sensitive user directories like ~/.ssh or ~/.aws.
output_path = Path("workflows")
→ No action needed - good practice
 scripts/
ResourceDeclaredInferredStatusEvidence
Filesystem READ WRITE ✓ Aligned Scripts write to workflows/, reports/, brainstorm_output/ directories - scoped a…
Network READ READ ✓ Aligned Makes API calls to WordPress, social media platforms as declared in SKILL.md
Shell WRITE WRITE ✓ Aligned Uses subprocess for Python script execution, documented and expected for CLI too…
Environment NONE NONE — No environment variable access observed in code
6 findings
🔗
Medium External URL 外部 URL
https://yourblog.com/wp-json
SKILL.md:234
🔗
Medium External URL 外部 URL
https://yourdomain.com/health
assets/config/api_config.example.json:117
📧
Info Email 邮箱地址
[email protected]
CLAWHUB_LISTING.md:282
📧
Info Email 邮箱地址
[email protected]
CLAWHUB_LISTING.md:347
📧
Info Email 邮箱地址
[email protected]
assets/config/api_config.example.json:39
📧
Info Email 邮箱地址
[email protected]
assets/config/api_config.example.json:115

File Tree

15 files · 103.1 KB · 3374 lines
Markdown 6f · 1855L Python 4f · 1135L JSON 4f · 264L JavaScript 1f · 120L
├─ ▾ 📁 assets
│ ├─ ▾ 📁 config
│ │ └─ 📋 api_config.example.json JSON 131L · 3.7 KB
│ └─ ▾ 📁 templates
│ ├─ ▾ 📁 social
│ │ └─ 📋 twitter_template.json JSON 48L · 1.9 KB
│ └─ 📝 blog_template.md Markdown 111L · 2.4 KB
├─ ▾ 📁 references
│ ├─ 📝 scheduled_blog.md Markdown 442L · 10.9 KB
│ └─ 📝 social_multi.md Markdown 558L · 14.0 KB
├─ ▾ 📁 scripts
│ ├─ ▾ 📁 workflow_templates
│ │ └─ 🐍 blog_automated.py Python 319L · 10.6 KB
│ ├─ 🐍 brainstorm.py Python 265L · 10.8 KB
│ ├─ 🐍 create_workflow.py Python 138L · 5.7 KB
│ └─ 🐍 run_workflow.py Python 413L · 15.0 KB
├─ ▾ 📁 test_workflows
│ └─ 📋 test-blog-pipeline.json JSON 60L · 1.1 KB
├─ 📝 CLAWHUB_LISTING.md Markdown 346L · 10.2 KB
├─ 📜 index.js JavaScript 120L · 3.1 KB
├─ 📋 package.json JSON 25L · 604 B
├─ 📝 README.md Markdown 29L · 644 B
└─ 📝 SKILL.md Markdown 369L · 12.6 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
No external Python dependencies N/A stdlib only No Uses only Python standard library (json, argparse, subprocess, pathlib, datetime)

Security Positives

✓ No base64 encoding/decoding or obfuscation detected
✓ No reverse shell or C2 communication patterns
✓ No credential harvesting or environment variable exfiltration
✓ Documentation accurately describes all capabilities
✓ API credentials documented as requiring environment variables in production
✓ File operations are scoped to specific application directories
✓ Uses standard Python libraries (json, argparse, subprocess) without suspicious patterns
✓ No hidden HTML comments or embedded payloads
✓ Test workflow file validates the implementation is legitimate
✓ Dependencies properly declared (no untracked packages)