中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 0/100
上次扫描：1 天前 重新扫描
0 /100
wip-license-hook
License rug-pull detection and dependency license compliance for open source projects
wip-license-hook is a legitimate open-source license compliance scanner. All functionality is accurately declared in SKILL.md. Shell/network access is limited to declared package manager tools (git, npm, pip, cargo) for the sole purpose of querying license metadata from official registries.
技能名称wip-license-hook
分析耗时42.4s
引擎pi
✓
可以安装
No action needed. The skill is safe to use.
资源类型声明权限推断权限状态证据
命令执行 WRITE WRITE ✓ 一致 SKILL.md declares requires.bins: [node, git, npm]; scanner.ts uses execSync for …
文件系统 READ+WRITE WRITE ✓ 一致 Reads LICENSE files, package.json, writes LICENSE-LEDGER.json and snapshots to p…
网络访问 READ READ ✓ 一致 Only queries official registries (npm, pip, cargo) for license metadata — not ar…
7 项发现
🔗
中危 外部 URL 外部 URL
https://img.shields.io/npm/v/@wipcomputer/wip-license-hook
README.md:3
🔗
中危 外部 URL 外部 URL
https://www.npmjs.com/package/@wipcomputer/wip-license-hook
README.md:3
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/interface-CLI_/_TUI-black
README.md:3
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/interface-MCP_Server-black
README.md:3
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/interface-Claude_Code_Skill-black
README.md:3
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/Universal_Interface_Spec-black?style=flat&color=black
README.md:3
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/$
dist/core/reporter.js:213

目录结构

27 文件 · 91.5 KB · 2757 行
TypeScript 12f · 1194L JavaScript 7f · 1016L Markdown 3f · 328L JSON 3f · 113L Shell 2f · 106L
├─ ▾ 📁 dist
│ ├─ ▾ 📁 cli
│ │ ├─ 📜 index.d.ts TypeScript 15L · 449 B
│ │ └─ 📜 index.js JavaScript 169L · 6.6 KB
│ └─ ▾ 📁 core
│ ├─ 📜 detector.d.ts TypeScript 12L · 564 B
│ ├─ 📜 detector.js JavaScript 103L · 2.9 KB
│ ├─ 📜 index.d.ts TypeScript 4L · 582 B
│ ├─ 📜 index.js JavaScript 4L · 495 B
│ ├─ 📜 ledger.d.ts TypeScript 49L · 1.7 KB
│ ├─ 📜 ledger.js JavaScript 71L · 2.1 KB
│ ├─ 📜 reporter.d.ts TypeScript 14L · 657 B
│ ├─ 📜 reporter.js JavaScript 226L · 9.7 KB
│ ├─ 📜 scanner.d.ts TypeScript 39L · 1.1 KB
│ └─ 📜 scanner.js JavaScript 324L · 11.4 KB
├─ ▾ 📁 hooks
│ ├─ 🔧 pre-pull.sh Shell 55L · 2.2 KB
│ └─ 🔧 pre-push.sh Shell 51L · 1.8 KB
├─ ▾ 📁 src
│ ├─ ▾ 📁 cli
│ │ └─ 📜 index.ts TypeScript 189L · 5.9 KB
│ └─ ▾ 📁 core
│ ├─ 📜 detector.ts TypeScript 130L · 3.1 KB
│ ├─ 📜 index.ts TypeScript 4L · 582 B
│ ├─ 📜 ledger.ts TypeScript 116L · 3.0 KB
│ ├─ 📜 reporter.ts TypeScript 255L · 9.6 KB
│ └─ 📜 scanner.ts TypeScript 367L · 10.9 KB
├─ 📝 CHANGELOG.md Markdown 17L · 723 B
├─ 📜 mcp-server.mjs JavaScript 119L · 3.6 KB
├─ 📋 package-lock.json JSON 54L · 1.6 KB
├─ 📋 package.json JSON 43L · 873 B
├─ 📝 README.md Markdown 200L · 6.1 KB
├─ 📝 SKILL.md Markdown 111L · 2.8 KB
└─ 📋 tsconfig.json JSON 16L · 345 B

依赖分析 3 项

包名版本来源已知漏洞备注
@modelcontextprotocol/sdk ^1.0.0 npm 否 Pinned to major version range
typescript ^5.3.0 npm 否 DevDependency, not shipped
@types/node ^20.0.0 npm 否 DevDependency, not shipped

安全亮点

✓ SKILL.md accurately describes all functionality — no doc-to-code mismatch
✓ No credential harvesting or sensitive data access
✓ No obfuscation (base64, eval, atob)
✓ No reverse shell, C2, or data exfiltration
✓ Network access limited to official package registries (npmjs.com, PyPI, crates.io)
✓ All shell commands are standard package manager tools for the declared purpose
✓ Dependencies (@modelcontextprotocol/sdk) are pinned to major version ranges
✓ Git hooks are advisory or blocking only within the project scope
✓ No hidden functionality — every feature maps to declared capabilities
✓ Filesystem writes are scoped to the target project directory