中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 10/100
上次扫描：1 天前 重新扫描
10 /100
finance-reporter
实时财经数据推送工具 - 使用Yahoo Finance API获取全球股市、外汇、大宗商品、加密货币实时行情
A legitimate finance data fetcher using Yahoo Finance API with no malicious behavior detected.
技能名称finance-reporter
分析耗时25.4s
引擎pi
✓
可以安装
Skill is safe to use. Optionally pin requests to exact version for supply chain hygiene.

安全发现 2 项

严重性 安全发现 位置
低危
Loosely pinned dependency version 供应链
package.json specifies requests ^2.28.0 with caret, allowing minor version updates. Consider pinning to exact version for reproducibility.
"requests": "^2.28.0"
→ Change to "requests": "2.28.0" for exact version pinning
 package.json:24
提示
Documentation mentions unimplemented features 文档欺骗
SKILL.md references curl binary and DingTalk/WeChat push notifications, but neither is used in the actual code. These are documented but not implemented - this is a documentation mismatch but not malicious.
"requires": { "bins": ["python3", "curl"] }
→ Remove curl from required binaries or implement the functionality
 SKILL.md:12
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No file operations in code
网络访问 READ READ ✓ 一致 tools/finance_data.py:36 - Only connects to query1.finance.yahoo.com
命令执行 NONE NONE — No subprocess or shell execution in code
环境变量 NONE NONE — No environment variable access
2 项发现
🔗
中危 外部 URL 外部 URL
https://finance.yahoo.com
SKILL.md:143
🔗
中危 外部 URL 外部 URL
https://query1.finance.yahoo.com/v8/finance/chart/
tools/finance_data.py:36

目录结构

4 文件 · 11.7 KB · 390 行
Markdown 2f · 213L Python 1f · 142L JSON 1f · 35L
├─ ▾ 📁 tools
│ └─ 🐍 finance_data.py Python 142L · 5.7 KB
├─ 📋 package.json JSON 35L · 780 B
├─ 📝 README.md Markdown 39L · 760 B
└─ 📝 SKILL.md Markdown 174L · 4.5 KB

依赖分析 1 项

包名版本来源已知漏洞备注
requests ^2.28.0 pip 否 Loose version pinning with caret, minor update risk

安全亮点

✓ No credential harvesting or sensitive data access
✓ No shell execution or subprocess usage
✓ No data exfiltration to external servers (only Yahoo Finance API)
✓ No obfuscation or base64-encoded payloads
✓ Clean, readable code with proper error handling
✓ Network requests limited to legitimate financial data API
✓ Uses standard requests library with known-good User-Agent
✓ Implements retry logic with backoff for reliability