中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:18 hr ago Rescan
20 /100
scienceclaw-watch
Run a live multi-agent scientific collaboration session and return a full summary when complete
Documentation-only skill with no implementation code present. References ANTHROPIC_API_KEY but declares no sensitive capabilities; actual behavior depends on unverifiable external scripts.
Skill Namescienceclaw-watch
Duration37.5s
Enginepi
✓
Safe to install
Provide the actual bin/scienceclaw-watch Python script for full code review. Without it, the skill cannot be validated against its documentation.

Findings 3 items

Severity Finding Location
Low
No implementation code to audit Doc Mismatch
SKILL.md describes running bin/scienceclaw-watch but the actual Python script is not present. The skill cannot be validated without reviewing the implementation.
python3 bin/scienceclaw-watch
→ Include bin/scienceclaw-watch and supporting modules in the skill package for security review
 SKILL.md:1
Low
Hardcoded path dependency with no existence checks Priv Escalation
Skill assumes $HOME/scienceclaw exists and contains bin/scienceclaw-watch. If the directory is compromised or replaced, arbitrary code could execute.
cd "$SCIENCECLAW_DIR" && python3 bin/scienceclaw-watch
→ Validate SCIENCECLAW_DIR exists and contains expected structure before execution
 SKILL.md:31
Info
Undocumented credential dependency Sensitive Access
Metadata specifies ANTHROPIC_API_KEY as primaryEnv but SKILL.md does not document how or whether credentials are handled, accessed, or stored.
"primaryEnv": "ANTHROPIC_API_KEY"
→ Document credential access patterns in SKILL.md
 SKILL.md:2
ResourceDeclaredInferredStatusEvidence
Filesystem NONE READ+WRITE ✓ Aligned SKILL.md writes to $OUTPUT_DIR and reads session_summary.json
Shell NONE WRITE ✓ Aligned SKILL.md executes bash commands with python3 and activates .venv
Network NONE UNKNOWN ✓ Aligned Uses ANTHROPIC_API_KEY suggesting API calls, but not documented
Environment NONE READ ✓ Aligned References ANTHROPIC_API_KEY and SCIENCECLAW_DIR environment variables
Skill Invoke NONE READ ✓ Aligned Mentions scienceclaw-post and scienceclaw-investigate as follow-up skills

File Tree

1 files · 4.6 KB · 123 lines
Markdown 1f · 123L
└─ 📝 SKILL.md Markdown 123L · 4.6 KB

Security Positives

✓ No direct shell command injection vectors observed in documentation
✓ No base64-encoded or obfuscated commands in documentation
✓ No credential harvesting or exfiltration patterns described
✓ No network IOCs or external IP addresses mentioned
✓ Output directory is sandboxed under run_exports/ with timestamps