中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 20/100
上次扫描：1 天前 重新扫描
20 /100
微信公众号文章深度分析
微信公众号文章深度分析工具，用于读取和分析微信公众号文章内容
Legitimate WeChat public account article analyzer with no malicious behavior; minor documentation mismatch regarding filesystem access for output files.
技能名称微信公众号文章深度分析
分析耗时38.7s
引擎pi
✓
可以安装
Consider documenting filesystem:WRITE permission in SKILL.md for output file generation, otherwise safe to use.

安全发现 1 项

严重性 安全发现 位置
低危
Minor documentation mismatch 文档欺骗
SKILL.md declares filesystem:NONE but the script writes output files when --output flag is provided. This is mentioned in usage examples but not in the resource declaration.
allowed-tools mapping does not include filesystem:WRITE
→ Update SKILL.md to declare filesystem:WRITE for output file generation capability
 SKILL.md:1
资源类型声明权限推断权限状态证据
文件系统 NONE WRITE ✓ 一致 scripts/analyze_wechat.py:lines 377-385 (file write with --output flag)
网络访问 READ READ ✓ 一致 scripts/analyze_wechat.py:lines 33-60 (requests.get only to user-provided URLs)
命令执行 NONE NONE — No subprocess or shell execution found
环境变量 NONE NONE — No os.environ access found
1 高危 3 项发现
📡
高危 IP 地址 硬编码 IP 地址
123.0.0.0
scripts/analyze_wechat.py:20
🔗
中危 外部 URL 外部 URL
https://mp.weixin.qq.com/s/pr6pCoRCFKeWDyr5xoBrjQ
README.md:58
🔗
中危 外部 URL 外部 URL
https://mp.weixin.qq.com/s/xxx
README.md:66

目录结构

4 文件 · 19.9 KB · 664 行
Python 1f · 444L Markdown 2f · 218L Text 1f · 2L
├─ ▾ 📁 scripts
│ └─ 🐍 analyze_wechat.py Python 444L · 14.6 KB
├─ 📝 README.md Markdown 99L · 2.3 KB
├─ 📄 requirements.txt Text 2L · 31 B
└─ 📝 SKILL.md Markdown 119L · 2.9 KB

依赖分析 2 项

包名版本来源已知漏洞备注
requests >=2.25.0 pip 否 Version properly pinned with minimum constraint
pyyaml >=5.4.0 pip 否 Version properly pinned with minimum constraint

安全亮点

✓ No shell execution - uses only Python standard library
✓ No credential harvesting - does not access environment variables or sensitive paths
✓ No data exfiltration - all network requests are to user-provided WeChat URLs only
✓ No obfuscation - clean, readable code with no base64 or encoded payloads
✓ Dependencies are version-pinned (requests>=2.25.0, pyyaml>=5.4.0)
✓ Explicit user consent required for file writes via --output flag
✓ No external connections to suspicious IPs - pre-scan '123.0.0.0' flag is a false positive (it's Chrome browser version)