中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 20/100
上次扫描：1 天前 重新扫描
20 /100
kindle2md
Convert Kindle HTML notebook exports to Obsidian Markdown format
A straightforward Kindle-to-Markdown converter with minor documentation gaps but no malicious behavior detected.
技能名称kindle2md
分析耗时29.2s
引擎pi
✓
可以安装
Consider adding explicit declaration of clipboard and filesystem WRITE capabilities to SKILL.md for full transparency.

安全发现 2 项

严重性 安全发现 位置
低危
Clipboard access undocumented 文档欺骗
The script uses pyperclip to copy markdown output to clipboard, but this capability is not declared in SKILL.md
if args.clipboard:
      pyperclip.copy(md)
→ Add '-c/--clipboard' feature to SKILL.md capabilities documentation
 scripts/kindle_notes_to_md.py:183
低危
Filesystem WRITE permission implied but not declared 文档欺骗
SKILL.md describes file output functionality but only explicitly declares READ permission for config reading
Use this skill to convert Kindle HTML notebook exports to Obsidian Markdown format
→ Clarify that the skill requires filesystem WRITE permission for output .md files
 SKILL.md:1
资源类型声明权限推断权限状态证据
文件系统 READ WRITE ✓ 一致 SKILL.md describes file output but declares only READ for config
网络访问 NONE NONE — No network operations observed
命令执行 WRITE WRITE ✓ 一致 SKILL.md declares python script execution
环境变量 NONE NONE — No environment variable access
技能调用 NONE NONE — No skill invocation
剪贴板 NONE READ ✓ 一致 pyperclip.copy() at line 183
浏览器 NONE NONE — No browser operations
数据库 NONE NONE — No database access

目录结构

3 文件 · 10.4 KB · 327 行
Python 1f · 264L Markdown 2f · 63L
├─ ▾ 📁 references
│ └─ 📝 config.md Markdown 8L · 325 B
├─ ▾ 📁 scripts
│ └─ 🐍 kindle_notes_to_md.py Python 264L · 8.3 KB
└─ 📝 SKILL.md Markdown 55L · 1.8 KB

依赖分析 3 项

包名版本来源已知漏洞备注
beautifulsoup4 * pip 否 Standard HTML parser library
pyperclip * pip 否 Cross-platform clipboard access
eglogging * pip 否 Logging utility

安全亮点

✓ No network requests or external communication
✓ No credential harvesting or environment variable access
✓ No obfuscation, base64 encoding, or anti-analysis techniques
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)
✓ No remote code execution or shell command injection
✓ Uses legitimate, well-known Python libraries (BeautifulSoup, pyperclip)
✓ File operations are limited to user-provided input and configured output directory
✓ No persistence mechanisms or backdoors
✓ No supply chain risks - dependencies are standard libraries