中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 22/100
上次扫描：21 小时前 重新扫描
22 /100
api-translator
將 API 文檔翻譯成繁體中文
Skill provides legitimate API translation but uses undocumented shell execution via subprocess to invoke web_fetch CLI, creating a minor doc-to-code mismatch without actual malicious behavior.
技能名称api-translator
分析耗时38.4s
引擎pi
✓
可以安装
Add explicit declaration of shell execution and subprocess usage in SKILL.md capabilities section. Implement the documented --format, --preserve-code, and --taiwan parameters in the scripts.

安全发现 2 项

严重性 安全发现 位置
低危
Undocumented Shell Execution via Subprocess 文档欺骗
SKILL.md declares web_fetch tool usage but does not mention that the implementation uses subprocess.run() to invoke web_fetch as a CLI command in api-translator.py:17
subprocess.run(["web_fetch", "--url", url, "--maxChars", "50000"], capture_output=True, text=True)
→ Add 'shell: WRITE' to declared capabilities if subprocess usage is intentional, or refactor to use web_fetch tool directly
 scripts/api-translator.py:17
低危
Documented Parameters Not Implemented 文档欺骗
SKILL.md describes --format, --preserve-code, and --taiwan translation options (v1.1.0 features), but neither python nor bash scripts implement these parameters
--format | 輸出格式 (markdown/json/txt)
→ Either implement the documented parameters or remove them from SKILL.md
 SKILL.md:48
资源类型声明权限推断权限状态证据
网络访问 READ READ ✓ 一致 SKILL.md declares web_fetch tool usage
命令执行 NONE WRITE ✗ 越权 scripts/api-translator.py:17 uses subprocess.run()
文件系统 NONE NONE — No filesystem access in scripts
环境变量 NONE NONE — No environment variable access
技能调用 NONE NONE — No skill invocation
2 项发现
🔗
中危 外部 URL 外部 URL
https://platform.openai.com/docs/api-reference/introduction
SKILL.md:76
🔗
中危 外部 URL 外部 URL
https://api.example.com/docs
scripts/api-translator.py:23

目录结构

4 文件 · 3.9 KB · 172 行
Markdown 1f · 82L Python 1f · 50L Shell 1f · 33L JSON 1f · 7L
├─ ▾ 📁 scripts
│ ├─ 🐍 api-translator.py Python 50L · 1.3 KB
│ └─ 🔧 api-translator.sh Shell 33L · 742 B
├─ 📋 _meta.json JSON 7L · 156 B
└─ 📝 SKILL.md Markdown 82L · 1.7 KB

安全亮点

✓ No credential theft or harvesting behavior observed
✓ No sensitive file/path access (no ~/.ssh, ~/.aws, .env)
✓ No data exfiltration to external IPs
✓ No obfuscation techniques (base64, eval, etc.)
✓ No curl|bash or wget|sh remote script execution
✓ No malicious dependencies detected
✓ web_fetch tool usage is properly declared in documentation
✓ Scripts are straightforward wrappers without hidden functionality