中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：1 天前 重新扫描
15 /100
auto-free-banana
Generates images in Google Flow through browser UI automation
This is a legitimate browser UI automation tool for Google Flow that stores OAuth tokens locally. No malicious behavior, credential theft, or data exfiltration detected. All shell/network access is declared and necessary for the tool's stated purpose.
技能名称auto-free-banana
分析耗时38.3s
引擎pi
✓
可以安装
No action required. The skill is safe for use within its documented scope of Google Flow UI automation.
资源类型声明权限推断权限状态证据
命令执行 WRITE WRITE ✓ 一致 SKILL.md: Script Directory section declares bun/npx execution
文件系统 WRITE WRITE ✓ 一致 SKILL.md: Cookie storage in ~/.local/share/baoyu-skills; cookies.json written lo…
网络访问 READ READ ✓ 一致 SKILL.md: Network connectivity check (curl to labs.google/fx); HTTP requests to …
浏览器 WRITE WRITE ✓ 一致 SKILL.md: Chrome CDP automation declared; client.ts uses CDP for UI control
环境变量 READ READ ✓ 一致 SKILL.md: Environment variables section lists proxy, paths, and debug port setti…
6 项发现
🔗
中危 外部 URL 外部 URL
https://labs.google/fx/
SKILL.md:162
🔗
中危 外部 URL 外部 URL
https://labs.google/fx/zh/tools/flow
scripts/flow-webapi/client.ts:83
🔗
中危 外部 URL 外部 URL
https://labs.google/fx/zh/tools/flow/project/$
scripts/flow-webapi/client.ts:174
🔗
中危 外部 URL 外部 URL
https://labs.google/fx/api/auth/session
scripts/flow-webapi/utils/get-auth-token.ts:15
🔗
中危 外部 URL 外部 URL
https://labs.google/
scripts/flow-webapi/utils/load-browser-cookies.ts:342
🔗
中危 外部 URL 外部 URL
https://accounts.google.com/
scripts/flow-webapi/utils/load-browser-cookies.ts:342

目录结构

15 文件 · 58.4 KB · 1811 行
TypeScript 14f · 1529L Markdown 1f · 282L
├─ ▾ 📁 scripts
│ ├─ ▾ 📁 flow-webapi
│ │ ├─ ▾ 📁 types
│ │ │ ├─ 📜 index.ts TypeScript 1L · 78 B
│ │ │ └─ 📜 project.ts TypeScript 17L · 316 B
│ │ ├─ ▾ 📁 utils
│ │ │ ├─ 📜 cookie-file.ts TypeScript 56L · 1.5 KB
│ │ │ ├─ 🔑 get-auth-token.ts ⚠ TypeScript 97L · 3.3 KB
│ │ │ ├─ 📜 http.ts TypeScript 72L · 2.0 KB
│ │ │ ├─ 📜 index.ts TypeScript 25L · 826 B
│ │ │ ├─ 📜 load-browser-cookies.ts TypeScript 392L · 12.9 KB
│ │ │ ├─ 📜 logger.ts TypeScript 40L · 1.1 KB
│ │ │ └─ 📜 paths.ts TypeScript 55L · 2.0 KB
│ │ ├─ 📜 client.ts TypeScript 418L · 14.8 KB
│ │ ├─ 📜 constants.ts TypeScript 38L · 1.4 KB
│ │ ├─ 📜 exceptions.ts TypeScript 34L · 681 B
│ │ └─ 📜 index.ts TypeScript 32L · 601 B
│ └─ 📜 main.ts TypeScript 252L · 6.9 KB
└─ 📝 SKILL.md Markdown 282L · 10.0 KB

安全亮点

✓ All shell executions (bun/npx) are declared in SKILL.md
✓ Network requests are limited to official Google domains (labs.google/fx, accounts.google.com)
✓ OAuth tokens are stored locally in cookie files, not exfiltrated
✓ No base64-encoded commands or obfuscation detected
✓ No access to sensitive system paths (~/.ssh, ~/.aws, .env)
✓ No credential harvesting for external exfiltration
✓ Chrome spawning uses documented paths and flags
✓ Consent check mechanism implemented before first use
✓ Source code is clean TypeScript without suspicious patterns
✓ No reverse shell, C2, or data theft functionality