Tech Brief 安全扫描报告 — 低风险 | ClawSafe

20 /100

Tech Brief

科技资讯简报 - 追踪内存、AI、算力领域的最新资讯

Tech news aggregation skill with minor documentation gaps (undeclared subprocess usage) but no evidence of malicious behavior; hardcoded IP is a placeholder, not active C2.

技能名称Tech Brief

分析耗时42.8s

引擎pi

✓

可以安装

Add subprocess usage to SKILL.md if this behavior is intentional; verify the hardcoded IP is not used in production; consider pinning exact dependency versions for reproducibility.

安全发现 3 项

严重性	安全发现	位置
低危	Undeclared subprocess execution The daily_fetch.py script uses subprocess.run to invoke the policy script from a sibling skill directory, but this is not declared in SKILL.md or the allowed-tools mapping. `subprocess.run([sys.executable, str(policy_script), '--days', str(days)], capture_output=True, text=True)` → Add subprocess to allowed-tools mapping or document this cross-skill invocation in SKILL.md	`scripts/daily_fetch.py:55`
低危	Hardcoded IP address placeholder A hardcoded IP '120.0.0.0' appears in fetch_news.py but analysis shows it is unused placeholder data, not an active connection endpoint. `120.0.0.0` → Remove placeholder IP or replace with proper documentation	`scripts/fetch_news.py:72`
低危	Undeclared cross-skill file read The script reads policy data from a sibling skill directory (ai-policy-brief) without declaring skill_invoke permission. `policy_file = SCRIPT_DIR.parent / 'ai-policy-brief' / 'output' / 'policy.json'` → Document cross-skill dependencies in SKILL.md	`scripts/daily_fetch.py:44`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`WRITE`	✓ 一致	scripts/daily_fetch.py:93 - creates output directory and writes brief.md
网络访问	`READ`	`READ`	✓ 一致	RSS feeds, HTML scraping, and API calls to Weibo/Zhihu/Bilibili documented in so…
命令执行	`NONE`	`WRITE`	✓ 一致	scripts/daily_fetch.py:55-62 - subprocess.run to execute policy script
环境变量	`NONE`	`NONE`	—	No access to environment variables detected
技能调用	`NONE`	`READ`	✓ 一致	scripts/daily_fetch.py:44-45 - reads from sibling skill directory ai-policy-brie…

1 高危 40 项发现

📡

高危 IP 地址硬编码 IP 地址

120.0.0.0

scripts/fetch_news.py:72

🔗

中危外部 URL 外部 URL

https://www.techpowerup.com/rss/

references/sources.md:9

🔗

中危外部 URL 外部 URL

https://www.tomshardware.com/feeds/all

references/sources.md:10

🔗

中危外部 URL 外部 URL

https://www.anandtech.com/rss/

references/sources.md:11

🔗

中危外部 URL 外部 URL

https://www.theverge.com/rss/index.xml

references/sources.md:12

🔗

中危外部 URL 外部 URL

https://feeds.arstechnica.com/arstechnica/index

references/sources.md:13

🔗

中危外部 URL 外部 URL

https://www.expreview.com/

references/sources.md:19

🔗

中危外部 URL 外部 URL

https://www.mydrivers.com/

references/sources.md:20

🔗

中危外部 URL 外部 URL

https://www.pcpop.com/

references/sources.md:21

🔗

中危外部 URL 外部 URL

https://www.ithome.com/

references/sources.md:22

🔗

中危外部 URL 外部 URL

https://www.huxiu.com/

references/sources.md:23

🔗

中危外部 URL 外部 URL

https://36kr.com/

references/sources.md:24

🔗

中危外部 URL 外部 URL

https://www.samsung.com/semiconductor/

references/sources.md:30

🔗

中危外部 URL 外部 URL

https://www.skhynix.com/

references/sources.md:31

🔗

中危外部 URL 外部 URL

https://www.micron.com/

references/sources.md:32

🔗

中危外部 URL 外部 URL

https://nvidianews.nvidia.com/

references/sources.md:33

🔗

中危外部 URL 外部 URL

https://www.amd.com/en/newsroom.html

references/sources.md:34

🔗

中危外部 URL 外部 URL

https://www.intel.com/content/www/us/en/newsroom/news.html

references/sources.md:35

🔗

中危外部 URL 外部 URL

https://www.gov.cn/

references/sources.md:45

🔗

中危外部 URL 外部 URL

https://www.cac.gov.cn/

references/sources.md:46

🔗

中危外部 URL 外部 URL

https://www.miit.gov.cn/

references/sources.md:47

🔗

中危外部 URL 外部 URL

https://www.most.gov.cn/

references/sources.md:48

🔗

中危外部 URL 外部 URL

https://www.ndrc.gov.cn/

references/sources.md:49

🔗

中危外部 URL 外部 URL

https://www.gd.gov.cn/

references/sources.md:55

🔗

中危外部 URL 外部 URL

https://www.gz.gov.cn/

references/sources.md:56

🔗

中危外部 URL 外部 URL

https://www.sz.gov.cn/

references/sources.md:57

🔗

中危外部 URL 外部 URL

https://smartcity.team/

references/sources.md:63

🔗

中危外部 URL 外部 URL

https://weibo.com/ajax/side/hotSearch

references/sources.md:71

🔗

中危外部 URL 外部 URL

https://www.zhihu.com/api/v3/feed/topstory/hot-lists/total

references/sources.md:72

🔗

中危外部 URL 外部 URL

https://api.bilibili.com/x/web-interface/popular

references/sources.md:73

🔗

中危外部 URL 外部 URL

https://top.baidu.com/board?tab=realtime

references/sources.md:74

🔗

中危外部 URL 外部 URL

https://www.huodongxing.com/

references/sources.md:82

🔗

中危外部 URL 外部 URL

https://www.hudongba.com/

references/sources.md:83

🔗

中危外部 URL 外部 URL

https://www.huodongjia.com/

references/sources.md:84

🔗

中危外部 URL 外部 URL

https://www.zhihu.com/api/v3/feed/topstory/hot-lists/total?limit=10

scripts/fetch_trends.py:34

🔗

中危外部 URL 外部 URL

https://weibo.com

scripts/fetch_trends.py:59

🔗

中危外部 URL 外部 URL

https://s.weibo.com/weibo?q=

scripts/fetch_trends.py:81

🔗

中危外部 URL 外部 URL

https://www.zhihu.com

scripts/fetch_trends.py:104

🔗

中危外部 URL 外部 URL

https://api.bilibili.com/x/web-interface/popular?ps=20&pn=1

scripts/fetch_trends.py:150

🔗

中危外部 URL 外部 URL

https://www.bilibili.com/video/

scripts/fetch_trends.py:166

目录结构

6 文件 · 26.7 KB · 939 行

Python 3f · 701L Markdown 2f · 232L Text 1f · 6L

├─ ▾ 📁 references

│ └─ 📝 sources.md Markdown 108L · 2.7 KB

├─ ▾ 📁 scripts

│ ├─ 🐍 daily_fetch.py Python 186L · 5.7 KB

│ ├─ 🐍 fetch_news.py Python 256L · 7.5 KB

│ └─ 🐍 fetch_trends.py Python 259L · 7.7 KB

├─ 📄 requirements.txt Text 6L · 113 B

└─ 📝 SKILL.md Markdown 124L · 2.9 KB

依赖分析 5 项

包名	版本	来源	已知漏洞	备注
`requests`	`>=2.28.0`	pip	否	Minimum version specified; consider pinning exact version
`beautifulsoup4`	`>=4.12.0`	pip	否	Minimum version specified; consider pinning exact version
`lxml`	`>=4.9.0`	pip	否	Minimum version specified; consider pinning exact version
`python-dateutil`	`>=2.8.0`	pip	否	Minimum version specified; consider pinning exact version
`feedparser`	`>=6.0.0`	pip	否	Minimum version specified; consider pinning exact version

安全亮点

✓ No credential harvesting or environment variable enumeration detected

✓ No base64-encoded commands or eval() calls found

✓ No access to sensitive paths (~/.ssh, ~/.aws, .env) observed

✓ No data exfiltration to external IPs

✓ No reverse shell, C2, or reverse engineering behavior

✓ Dependencies (requests, beautifulsoup4) have no known critical vulnerabilities at specified minimum versions

✓ All network requests target legitimate news sources (RSS feeds, tech media, social platforms)

✓ Output is written locally to output/ directory only