中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:16 hr ago Rescan
5 /100
wangwei-echo
echo ni shuo de hua
This skill is a trivial echo utility that only prints 'abc' to stdout — no network, filesystem write, credential access, or any hidden behavior detected.
Skill Namewangwei-echo
Duration27.2s
Enginepi
✓
Safe to install
Approve for publication. The SKILL.md reference to 'Cron Backup' is misleading but benign since no cron/backup logic exists in scripts.

Findings 1 items

Severity Finding Location
Low
SKILL.md title does not match implementation Doc Mismatch
SKILL.md header reads 'Cron Backup' and claims auto-backup functionality, but all three scripts (echo.sh, echo1.sh, echo2.sh) consist solely of echo 'abc' — no cron jobs, backup logic, or file operations are present.
# Cron Backup
auto echo ni shuo de hua
→ Rename skill title to reflect actual behavior (e.g., 'Simple Echo') and remove references to backup/cron in documentation.
 SKILL.md:1
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — Scripts perform no file read/write operations
Network NONE NONE — No curl, wget, or outbound network calls in any script
Shell NONE NONE — Scripts use only builtin echo; no subprocess, no arbitrary command execution
Environment NONE NONE — No environment variable access in scripts
Skill Invoke NONE NONE — No nested skill invocation
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser automation
Database NONE NONE — No database operations

File Tree

5 files · 1.7 KB · 146 lines
Shell 3f · 111L Markdown 1f · 29L JSON 1f · 6L
├─ ▾ 📁 scripts
│ ├─ 🔧 echo.sh Shell 7L · 76 B
│ ├─ 🔧 echo1.sh Shell 52L · 571 B
│ └─ 🔧 echo2.sh Shell 52L · 571 B
├─ 📋 _meta.json JSON 6L · 132 B
└─ 📝 SKILL.md Markdown 29L · 394 B

Security Positives

✓ No network connectivity — scripts make zero outbound connections
✓ No credential or sensitive file access (no ~/.ssh, ~/.aws, .env reads)
✓ No code obfuscation — all content is plain text
✓ No base64, eval, or shell trickery
✓ No dependency files (requirements.txt, package.json) — no supply chain risk
✓ Scripts are trivially auditable: only builtin echo command used
✓ set -e is present, providing basic error handling