扫描报告
5 /100
gusnais-skill
Gusnais (Ruby-China/Homeland compatible) API integration with OAuth and plugin domain operations
This is a legitimate Gusnais/Ruby-China forum API integration skill with standard OAuth authentication and plugin domain operations. No malicious behavior detected.
可以安装
This skill is safe to use. No security concerns identified.
| 资源类型 | 声明权限 | 推断权限 | 状态 | 证据 |
|---|---|---|---|---|
| 网络访问 | READ | READ | ✓ 一致 | Both scripts use requests to communicate with hardcoded https://gusnais.com |
| 文件系统 | WRITE | WRITE | ✓ 一致 | write_token_store() in gusnais_bootstrap.py line 134; save() in gusnais_plugin_c… |
| 环境变量 | NONE | READ | ✓ 一致 | Both scripts read CLIENT_ID, CLIENT_SECRET, etc. from os.environ, which is stand… |
1 项发现
中危 外部 URL 外部 URL
https://gusnais.com SKILL.md:18 目录结构
5 文件 · 30.5 KB · 891 行 Python 2f · 549L
Markdown 3f · 342L
├─
▾
references
│ ├─
endpoints.md
Markdown
│ └─
permission-parity.md
Markdown
├─
▾
scripts
│ ├─
gusnais_bootstrap.py
Python
│ └─
gusnais_plugin_client.py
Python
└─
SKILL.md
Markdown
依赖分析 1 项
| 包名 | 版本 | 来源 | 已知漏洞 | 备注 |
|---|---|---|---|---|
requests | * | pip | 否 | Version not pinned; standard library with no security impact in this context |
安全亮点
✓ SKILL.md accurately describes all functionality implemented in scripts
✓ All network requests are to hardcoded, whitelisted domain https://gusnais.com
✓ Credentials (CLIENT_ID, CLIENT_SECRET) are user-provided inputs, not harvested
✓ Token store file is written with restrictive permissions (chmod 0o600)
✓ No shell execution, subprocess, or command injection vectors
✓ No obfuscation, base64 payloads, or hidden functionality
✓ OAuth flow is a standard, well-structured implementation
✓ No data exfiltration or C2 communication patterns
✓ Plugin API client has proper error handling and capability gating
✓ No supply chain risks beyond unpinned requests dependency