中文 EN

扫描报告

扫描新文件

✓ 低风险 — 风险评分 5/100
上次扫描：1 天前 重新扫描
5 /100
bracketsbot-skill
Generate, validate, and submit BracketsBot NCAA tournament brackets.
BracketsBot is a legitimate NCAA tournament bracket generation and submission CLI. All capabilities are declared in SKILL.md. No malicious behavior, credential harvesting, obfuscation, or supply chain risks found.
技能名称bracketsbot-skill
分析耗时46.0s
引擎pi
✓
可以安装
No action needed. The skill is safe to use as described.

安全发现 2 项

严重性 安全发现 位置
低危
Minor doc-to-code mismatch on filesystem writes 文档欺骗
SKILL.md does not explicitly declare that the skill writes prediction output files to ./out/. While this is a benign feature, it should be documented.
Writes to ./out/model-bracket-output.json and ./out/model-walk-picks.json
→ Add a 'File Outputs' section to SKILL.md listing writable paths (./out/*).
 SKILL.md:1
低危
Environment variable access not declared 文档欺骗
SKILL.md does not document that CLI commands pass through process.env (TOURNAMENT_FILE, TEAM_DATA_FILE, CHAIN_ID, etc.) to child scripts.
env: { ...process.env, ...env }
→ Document environment variable usage in SKILL.md or at minimum in CLI --help output.
 scripts/cli.mjs:30
资源类型声明权限推断权限状态证据
命令执行 WRITE WRITE ✓ 一致 scripts/cli.mjs:14 — child_process.spawn for Node script execution
文件系统 READ READ+WRITE ✓ 一致 Writes to ./out/ directory for predictions and walk state
网络访问 READ READ ✓ 一致 POST/PATCH/GET to https://brackets.bot/api/* only
环境变量 NONE READ ✓ 一致 process.env passed through to child scripts (TOURNAMENT_FILE, TEAM_DATA_FILE, et…
11 项发现
🔗
中危 外部 URL 外部 URL
https://brackets.bot/?p=$
README.md:81
🔗
中危 外部 URL 外部 URL
https://www.sports-reference.com/cbb/seasons/men/2026-ratings.html
reference/2026-season-guide.md:67
🔗
中危 外部 URL 外部 URL
https://kenpom.com
reference/2026-season-guide.md:68
🔗
中危 外部 URL 外部 URL
https://barttorvik.com
reference/2026-season-guide.md:69
🔗
中危 外部 URL 外部 URL
https://www.espn.com/mens-college-basketball/bpi
reference/2026-season-guide.md:70
🔗
中危 外部 URL 外部 URL
https://json-schema.org/draft/2020-12/schema
schema/bracket-output.schema.json:2
🔗
中危 外部 URL 外部 URL
https://basedketball.xyz/schemas/bracketsbot/bracket-output.schema.json
schema/bracket-output.schema.json:3
🔗
中危 外部 URL 外部 URL
https://basedketball.xyz/schemas/bracketsbot/team-data.schema.json
schema/team-data.schema.json:3
🔗
中危 外部 URL 外部 URL
https://basedketball.xyz/schemas/bracketsbot/tournament.schema.json
schema/tournament.schema.json:3
🔗
中危 外部 URL 外部 URL
https://brackets.bot
scripts/cli.mjs:342
💰
中危 钱包地址 加密货币钱包地址
0x8d9a08b06a64be28a3a7b5e5b820561a1876b655
scripts/prepare-submit-transaction.mjs:68

目录结构

26 文件 · 125.8 KB · 4598 行
JavaScript 14f · 2113L JSON 6f · 1945L Markdown 5f · 527L Shell 1f · 13L
├─ ▾ 📁 data
│ └─ 📋 team-data.json JSON 812L · 17.7 KB
├─ ▾ 📁 examples
│ ├─ ▾ 📁 policies
│ │ └─ 📜 simple-rating-policy.mjs JavaScript 13L · 448 B
│ └─ ▾ 📁 wallet-submission
│ └─ 🔧 bankr-cli-submit.sh Shell 13L · 363 B
├─ ▾ 📁 reference
│ ├─ 📝 2026-season-guide.md Markdown 97L · 4.4 KB
│ ├─ 📋 tournament.json JSON 924L · 18.0 KB
│ ├─ 📝 WALK_STATE.md Markdown 94L · 2.2 KB
│ └─ 📝 WALLET_INTEGRATIONS.md Markdown 69L · 1.8 KB
├─ ▾ 📁 schema
│ ├─ 📋 bracket-output.schema.json JSON 64L · 1.5 KB
│ ├─ 📋 team-data.schema.json JSON 74L · 1.7 KB
│ └─ 📋 tournament.schema.json JSON 47L · 1.2 KB
├─ ▾ 📁 scripts
│ ├─ ▾ 📁 lib
│ │ └─ 📜 bracket-walk.mjs JavaScript 201L · 5.6 KB
│ ├─ 📜 build-example-team-data.mjs JavaScript 71L · 2.1 KB
│ ├─ 📜 build-season-guide.mjs JavaScript 128L · 4.5 KB
│ ├─ 📜 build-team-data.mjs JavaScript 157L · 5.4 KB
│ ├─ 📜 cli.mjs JavaScript 368L · 12.7 KB
│ ├─ 📜 generate-bracketsbot-bracket.mjs JavaScript 189L · 5.3 KB
│ ├─ 📜 prepare-submit-transaction.mjs JavaScript 172L · 5.1 KB
│ ├─ 📜 semantic-run.mjs JavaScript 136L · 3.7 KB
│ ├─ 📜 share-link.mjs JavaScript 123L · 3.8 KB
│ ├─ 📜 validate-bracketsbot.mjs JavaScript 237L · 7.1 KB
│ ├─ 📜 walk-apply-pick.mjs JavaScript 79L · 2.2 KB
│ ├─ 📜 walk-next-game.mjs JavaScript 106L · 2.8 KB
│ └─ 📜 walk-run-policy.mjs JavaScript 133L · 3.7 KB
├─ 📋 package.json JSON 24L · 657 B
├─ 📝 README.md Markdown 122L · 4.2 KB
└─ 📝 SKILL.md Markdown 145L · 7.9 KB

依赖分析 2 项

包名版本来源已知漏洞备注
viem ^2.22.17 npm 否 Standard EVM library, version pinned to 2.x range
incur ^0.3.3 npm 否 CLI framework, minor version range

安全亮点

✓ No credential harvesting or API key theft observed
✓ No base64 encoding or obfuscation of commands
✓ No attempts to access sensitive paths (~/.ssh, ~/.aws, .env)
✓ No curl|bash or wget|sh remote script execution
✓ No reverse shell, C2, or data exfiltration
✓ No malicious dependencies in package.json (only viem and incur, both well-known)
✓ Dependencies use semver ranges but no known malicious packages present
✓ Network access is limited to a single declared API endpoint (brackets.bot)
✓ File I/O is scoped to ./out/ directory and reference/data directories
✓ Dynamic policy module import is declared in SKILL.md (walk-run-policy command)
✓ All shell usage is documented CLI fallback commands (pnpm run cli ...)