扫描报告
10 /100
st-ent-mcp
Search 699pic enterprise photo/video assets, check download records, and generate download links through the local 699pic OpenAPI integration
This is a legitimate 699pic enterprise stock media asset search skill with proper credential handling via environment variables and no malicious indicators.
可以安装
This skill is safe to use. Ensure SERVICE_API_KEY is sourced from your own environment, not shared credentials.
| 资源类型 | 声明权限 | 推断权限 | 状态 | 证据 |
|---|---|---|---|---|
| 文件系统 | NONE | NONE | — | No filesystem access in openapi.js |
| 网络访问 | READ | READ | ✓ 一致 | POST requests to SERVICE_API_BASE_URL for asset search |
| 命令执行 | WRITE | WRITE | ✓ 一致 | Shell wrappers use mcporter, declared in SKILL.md |
| 环境变量 | READ | READ | ✓ 一致 | Reads SERVICE_API_KEY and SERVICE_API_BASE_URL |
1 项发现
中危 外部 URL 外部 URL
https://pre-st-api.699pic.com SKILL.md:18 目录结构
6 文件 · 11.4 KB · 336 行 Markdown 2f · 210L
JavaScript 1f · 88L
Shell 2f · 34L
YAML 1f · 4L
├─
▾
agents
│ └─
openai.yaml
YAML
├─
▾
references
│ └─
api.md
Markdown
├─
▾
scripts
│ ├─
openapi.js
JavaScript
│ ├─
search_photos.sh
Shell
│ └─
search_videos.sh
Shell
└─
SKILL.md
Markdown
安全亮点
✓ No hardcoded credentials - API key sourced from environment variable only
✓ SKILL.md documentation is comprehensive and matches implementation
✓ No obfuscation or encoded commands detected
✓ No suspicious network patterns (no direct IPs, no C2-style communication)
✓ Proper error handling with informative messages
✓ Uses native fetch API - no eval or dangerous execution patterns
✓ Configurable base URL prevents vendor lock-in concerns
✓ Download link generation requires explicit asset type and id (no guessing)