中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：1 天前 重新扫描
5 /100
ghostshield
Anti-colleague distillation shield - protects code style from AI extraction
GhostShield is a legitimate code obfuscation tool that analyzes and protects coding style from AI distillation. No malicious behavior, credential theft, or data exfiltration detected. All functionality is properly documented.
技能名称ghostshield
分析耗时40.0s
引擎pi
✓
可以安装
This skill is safe to use. Consider pinning dependency versions for better supply chain security.

安全发现 1 项

严重性 安全发现 位置
低危
Dependencies not version-pinned 供应链
requirements.txt uses loose versioning (>=) for packages like presidio-analyzer, spacy, jieba, gitpython. While not malicious, this is a best practice violation.
presidio-analyzer>=2.2.0
presidio-anonymizer>=2.2.0
spacy>=3.5.0
→ Pin exact versions to ensure reproducible builds and reduce supply chain risk
 requirements.txt:1
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 Operates on user-specified input paths only
命令执行 NONE READ ✓ 一致 Uses subprocess for git log analysis, documented and necessary for core function…
网络访问 NONE NONE — No network requests made
环境变量 NONE NONE — Does not access environment variables
7 项发现
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/License-GPLv3-blue.svg
README.md:5
🔗
中危 外部 URL 外部 URL
https://www.gnu.org/licenses/gpl-3.0
README.md:5
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/python-3.8+-blue.svg
README.md:6
🔗
中危 外部 URL 外部 URL
https://www.python.org/downloads/
README.md:6
🔗
中危 外部 URL 外部 URL
https://git.company.com/...
SKILL.md:55
📧
提示 邮箱 邮箱地址
[email protected]
README.md:122
📧
提示 邮箱 邮箱地址
[email protected]
SKILL.md:52

目录结构

10 文件 · 110.1 KB · 3455 行
Python 7f · 2795L Markdown 2f · 641L Text 1f · 19L
├─ ▾ 📁 ghostshield
│ ├─ 🐍 __init__.py Python 21L · 469 B
│ ├─ 🐍 cli.py Python 194L · 6.1 KB
│ ├─ 🐍 core.py Python 266L · 8.2 KB
│ ├─ 🐍 obfuscator.py Python 583L · 19.6 KB
│ ├─ 🐍 pii_detector.py Python 442L · 14.2 KB
│ ├─ 🐍 style_analyzer.py Python 734L · 24.6 KB
│ └─ 🐍 validator.py Python 555L · 18.6 KB
├─ 📝 README.md Markdown 280L · 7.6 KB
├─ 📄 requirements.txt Text 19L · 262 B
└─ 📝 SKILL.md Markdown 361L · 10.5 KB

依赖分析 5 项

包名版本来源已知漏洞备注
presidio-analyzer >=2.2.0 pip 否 Version not pinned
presidio-anonymizer >=2.2.0 pip 否 Version not pinned
spacy >=3.5.0 pip 否 Version not pinned
jieba >=0.42.1 pip 否 Version not pinned
gitpython >=3.1.0 pip 否 Version not pinned

安全亮点

✓ No credential harvesting or exfiltration
✓ No network requests to external IPs
✓ No base64/obfuscated code execution
✓ Documentation accurately describes all functionality
✓ All subprocess usage is legitimate git analysis (documented)
✓ No access to sensitive system paths (~/.ssh, ~/.aws, .env)
✓ No reverse shell or C2 communication
✓ Open source GPL-3.0 license with transparent codebase