中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：2 天前 重新扫描
5 /100
daily-idiom
每日成语学习 — Daily Chinese idiom learning with story, usage, examples, and quiz
A legitimate daily Chinese idiom learning skill with no malicious behavior detected.
技能名称daily-idiom
分析耗时26.4s
引擎pi
✓
可以安装
This skill is safe to use. The implementation is straightforward educational content generation with push notification management.

安全发现 1 项

严重性 安全发现 位置
低危
Dependencies not version pinned
package.json does not pin specific versions for dependencies. However, this is low risk since only built-in Node.js modules (fs, path) are used.
"dependencies": {}
→ Consider adding pinned versions if external dependencies are added in the future.
 package.json:1
资源类型声明权限推断权限状态证据
文件系统 READ WRITE ✓ 一致 SKILL.md declares node runtime; scripts read/write to data/users/ for user prefe…
网络访问 NONE NONE — No network access in any scripts
命令执行 READ READ ✓ 一致 Only documented node script invocations
环境变量 NONE NONE — No environment variable access
技能调用 NONE NONE — No cross-skill invocation
剪贴板 NONE NONE — No clipboard access
浏览器 NONE NONE — No browser automation
数据库 NONE NONE — No database access
1 项发现
🔗
中危 外部 URL 外部 URL
https://openclaw.ai
README.md:5

目录结构

7 文件 · 9.8 KB · 214 行
Markdown 2f · 114L JavaScript 3f · 85L JSON 2f · 15L
├─ ▾ 📁 scripts
│ ├─ 📜 evening-push.js JavaScript 18L · 1.3 KB
│ ├─ 📜 morning-push.js JavaScript 18L · 1.5 KB
│ └─ 📜 push-toggle.js JavaScript 49L · 3.5 KB
├─ 📋 _meta.json JSON 7L · 137 B
├─ 📋 package.json JSON 8L · 153 B
├─ 📝 README.md Markdown 53L · 1.6 KB
└─ 📝 SKILL.md Markdown 61L · 1.6 KB

依赖分析 1 项

包名版本来源已知漏洞备注
(built-in only) N/A Node.js stdlib 否 Uses only built-in modules: fs, path

安全亮点

✓ Path traversal protection implemented via safeUserPath() function with directory boundary checks
✓ Input validation on userId using strict regex pattern /^[a-zA-Z0-9_-]{1,128}$/
✓ Time sanitization prevents invalid cron expressions
✓ No credential harvesting or exfiltration
✓ No base64, eval(), or dynamic code execution
✓ No external network connections or IP addresses
✓ No sensitive path access (~/.ssh, ~/.aws, .env)
✓ No curl|bash or wget|sh remote script execution
✓ Uses only built-in Node.js modules (fs, path)
✓ Clear documentation of functionality in SKILL.md