ai-test-case-generator 安全扫描报告 — 可信 | ClawSafe

5 /100

ai-test-case-generator

AI自动生成测试用例工具。基于高级测试架构师角色，使用等价类划分、场景分析法、正交分解、状态迁移等方法生成覆盖全面的测试用例集。

This is a pure LLM prompt-based skill with no executable code. Network behavior (Markdown to Excel conversion) is fully declared and documented, and the SSL verification bypasses (-k flag, verify=False) are standard practices for internal corporate tools.

技能名称ai-test-case-generator

分析耗时32.8s

引擎pi

✓

可以安装

No action required. The skill is safe to use as documented.

安全发现 1 项

严重性	安全发现	位置
低危	SSL verification bypass documented as feature 文档欺骗 The skill includes curl -k flag and requests verify=False for internal network access. This is intentional and documented for corporate intranet environments. `curl -k -X POST "http://office-tools.wh.ctrm.5636cloud.com/api/v1/office/md-to-excel"` → This is standard practice for internal tools and does not pose a security risk when used in trusted internal networks.	`SKILL.md:118`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`NONE`	—	No file operations in skill definition
网络访问	`READ`	`READ`	✓ 一致	SKILL.md:118-143 - Declared API endpoint for Markdown to Excel conversion
命令执行	`NONE`	`NONE`	—	No shell execution; curl/python commands are documentation examples only
环境变量	`NONE`	`NONE`	—	No environment variable access
技能调用	`NONE`	`NONE`	—	No skill invocation
剪贴板	`NONE`	`NONE`	—	No clipboard access
浏览器	`NONE`	`NONE`	—	No browser access
数据库	`NONE`	`NONE`	—	No database access

2 项发现

🔗

中危外部 URL 外部 URL

http://office-tools.wh.ctrm.5636cloud.com/api/v1/office/md-to-excel

SKILL.md:118

🔗

中危外部 URL 外部 URL

http://office-tools.wh.ctrm.5636cloud.com/api/v1/office/download/20260309/测试用例_Excel格式_20260309165529.xlsx

SKILL.md:145

目录结构

1 文件 · 7.6 KB · 162 行

Markdown 1f · 162L

└─ 📝 SKILL.md Markdown 162L · 7.6 KB

安全亮点

✓ Pure LLM prompt-based skill with no executable code

✓ All network behavior is explicitly declared in documentation

✓ No credential harvesting or sensitive data access

✓ No obfuscation or hidden functionality

✓ No malicious dependencies or supply chain concerns

✓ Clear purpose and well-documented behavior

✓ No shell execution or file system manipulation