shopping-affiliate-search 安全扫描报告 — 低风险 | ClawSafe

10 /100

shopping-affiliate-search

全球购物搜索联盟工具 - 搜索淘宝/京东/亚马逊等平台商品，自动添加推荐码获取佣金

Legitimate shopping affiliate search tool with no malicious behavior detected. Uses only standard Python library, performs declared functionality, and stores config locally.

技能名称shopping-affiliate-search

分析耗时26.9s

引擎pi

✓

可以安装

No action required. The skill is a benign affiliate marketing tool.

安全发现 1 项

严重性	安全发现	位置
低危	Missing allowed-tools declaration 文档欺骗 SKILL.md does not explicitly declare allowed-tools mapping. While this is informational, best practice suggests declaring filesystem:WRITE and network:READ for this tool. `metadata: openclaw: emoji: 🛒` → Add allowed-tools section to metadata: filesystem:WRITE, network:READ	`SKILL.md:1`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`WRITE`	✓ 一致	SKILL.md:32-40 - config command writes to config/affiliate_config.json
网络访问	`NONE`	`READ`	✓ 一致	scripts/search.py:96-172 - constructs affiliate URLs for legitimate platforms
命令执行	`NONE`	`NONE`	—	No subprocess or shell execution found
环境变量	`NONE`	`NONE`	—	No environment variable access
凭据窃取	`NONE`	`NONE`	—	No credential harvesting - only accesses its own config file
剪贴板	`NONE`	`NONE`	—	No clipboard access
浏览器	`NONE`	`NONE`	—	No browser automation
数据库	`NONE`	`NONE`	—	No database access

19 项发现

🔗

中危外部 URL 外部 URL

https://pub.alimama.com

README.md:51

🔗

中危外部 URL 外部 URL

https://union.jd.com

README.md:56

🔗

中危外部 URL 外部 URL

https://jinbao.pinduoduo.com

README.md:61

🔗

中危外部 URL 外部 URL

https://affiliate-program.amazon.com

README.md:66

🔗

中危外部 URL 外部 URL

https://s.click.taobao.com/xxx

SKILL.md:87

🔗

中危外部 URL 外部 URL

https://s.click.taobao.com/yyy

SKILL.md:92

🔗

中危外部 URL 外部 URL

https://api.taobao.com

scripts/search.py:37

🔗

中危外部 URL 外部 URL

https://api.jd.com

scripts/search.py:42

🔗

中危外部 URL 外部 URL

https://api.pinduoduo.com

scripts/search.py:47

🔗

中危外部 URL 外部 URL

https://api.amazon.com

scripts/search.py:52

🔗

中危外部 URL 外部 URL

https://s.click.taobao.com/t?e=m%3D2%26s%3D

scripts/search.py:100

🔗

中危外部 URL 外部 URL

https://img.alicdn.com/example.jpg

scripts/search.py:101

🔗

中危外部 URL 外部 URL

https://img.alicdn.com/example2.jpg

scripts/search.py:111

🔗

中危外部 URL 外部 URL

https://union.jd.com/link?u=

scripts/search.py:129

🔗

中危外部 URL 外部 URL

https://img14.360buyimg.com/example.jpg

scripts/search.py:130

🔗

中危外部 URL 外部 URL

https://mobile.yangkeduo.com/duo_coupon.html?pid=

scripts/search.py:148

🔗

中危外部 URL 外部 URL

https://img.pddpic.com/example.jpg

scripts/search.py:149

🔗

中危外部 URL 外部 URL

https://www.amazon.com/s?k=

scripts/search.py:167

🔗

中危外部 URL 外部 URL

https://images-na.ssl-images-amazon.com/example.jpg

scripts/search.py:168

目录结构

3 文件 · 14.4 KB · 508 行

Python 1f · 274L Markdown 2f · 234L

├─ ▾ 📁 scripts

│ └─ 🐍 search.py Python 274L · 9.7 KB

├─ 📝 README.md Markdown 89L · 1.7 KB

└─ 📝 SKILL.md Markdown 145L · 3.0 KB

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`python3-stdlib`	`built-in`	standard library	否	No external dependencies

安全亮点

✓ Uses only Python standard library (no external dependencies with potential vulnerabilities)

✓ No subprocess or shell execution

✓ No credential harvesting from environment variables or sensitive paths

✓ No base64 or obfuscated code

✓ No hidden functionality - code behavior matches documentation

✓ Config stored in project directory, not system paths

✓ No network exfiltration or C2 communication

✓ No reverse shell or remote code execution