x-mobile-longshot 安全扫描报告 — 低风险 | ClawSafe

20 /100

x-mobile-longshot

Render X (Twitter) posts, long articles, and mobile reading pages into mobile-style long screenshots and optional single-page PDFs using Playwright.

This is a legitimate X/Twitter screenshot rendering tool with undocumented shell execution for PDF conversion, but the risk is minimal as file paths are script-generated and Playwright usage is properly documented.

技能名称x-mobile-longshot

分析耗时32.2s

引擎pi

✓

可以安装

Declare the filesystem WRITE and shell:WRITE permissions in SKILL.md for transparency. Consider moving Python image processing to a Node.js library to eliminate the spawnSync pattern.

安全发现 3 项

严重性	安全发现	位置
低危	Shell execution not declared in SKILL.md 文档欺骗 The script uses spawnSync to execute python3 with generated code for image processing (PIL/Pillow operations). This shell:WRITE capability is not mentioned in SKILL.md. `const r = spawnSync('python3', ['-c', code], { encoding: 'utf8' });` → Add 'shell:WRITE' to the declared allowed-tools mapping and document the Python dependency in SKILL.md	`scripts/render_x_longshot.js:77`
低危	Filesystem write access not declared 文档欺骗 The script creates directories and writes PNG/PDF files using Node.js fs module, but filesystem:WRITE is not declared in SKILL.md. `fs.mkdirSync(path.dirname(args.outPng), { recursive: true });` → Declare filesystem:WRITE permission in SKILL.md since the tool writes output files	`scripts/render_x_longshot.js:83`
提示	Python code injection via template strings 代码混淆 Python code is dynamically constructed with interpolated file paths. While inputs are script-generated (not user-supplied), this pattern could be risky if extended. `from PIL import Image raw = Image.open(r'''${rawPng}''').convert('RGB')` → Consider using a Node.js image library (e.g., sharp) instead of spawning Python processes to eliminate injection surface	`scripts/render_x_longshot.js:120`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`WRITE`	✗ 越权	scripts/render_x_longshot.js:83 fs.mkdirSync
命令执行	`NONE`	`WRITE`	✗ 越权	scripts/render_x_longshot.js:77 spawnSync('python3', ['-c', code])
浏览器	`READ`	`READ`	✓ 一致	scripts/render_x_longshot.js:89 chromium.launch() with user-provided URLs
网络访问	`READ`	`READ`	✓ 一致	scripts/render_x_longshot.js:91 page.goto(args.url)
环境变量	`NONE`	`NONE`	—	No environment variable access detected

1 项发现

🔗

中危外部 URL 外部 URL

https://x.com/i/status/2030475950752710891

SKILL.md:16

目录结构

3 文件 · 9.4 KB · 280 行

JavaScript 1f · 171L Markdown 2f · 109L

├─ ▾ 📁 references

│ └─ 📝 notes.md Markdown 29L · 1.5 KB

├─ ▾ 📁 scripts

│ └─ 📜 render_x_longshot.js JavaScript 171L · 5.1 KB

└─ 📝 SKILL.md Markdown 80L · 2.8 KB

依赖分析 2 项

包名	版本	来源	已知漏洞	备注
`playwright`	`*`	npm	否	No version pin - could install latest which may have vulnerabilities
`pillow`	`*`	pip	否	Runtime dependency via spawnSync, not declared in package.json

安全亮点

✓ No credential harvesting or sensitive file access

✓ No network exfiltration or C2 communication

✓ No base64 encoding or obfuscation patterns

✓ No curl|bash or remote script execution

✓ Browser automation via Playwright is properly documented

✓ File paths are script-generated, not user-controlled, reducing injection risk