中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:16 hr ago Rescan
5 /100
knowledge-graph-builder
知识图谱构建工具。从文档中自动提取知识和关系，支持图谱可视化、语义搜索、多种导出格式。
This is a legitimate knowledge graph builder skill with entirely stub implementations (TODO-only code). No malicious behavior, credential theft, network exfiltration, or obfuscation was found.
Skill Nameknowledge-graph-builder
Duration45.5s
Enginepi
✓
Safe to install
No action needed. This skill is safe to use. Note that it contains no functional implementation yet — all core modules are TODO stubs.

Findings 2 items

Severity Finding Location
Low
Dependencies loosely pinned Supply Chain
requirements.txt uses >= version constraints (spacy>=3.5.0, networkx>=3.0) without upper bounds, which could allow installation of unexpected future versions.
spacy>=3.5.0
networkx>=3.0
→ Pin exact versions or use compatible release operators (e.g., ~=) to ensure reproducible builds.
 requirements.txt:1
Info
Stub implementation mismatch Doc Mismatch
SKILL.md advertises '知识提取', '关系识别', '图谱可视化', '语义搜索' functionality, but all core Python modules contain only TODO stubs with no functional implementation. This is a doc-code mismatch of intent but not security consequence.
TODO: 使用 PyPDF2 解析; TODO: 使用 Ollama 增强实体信息
→ Implement advertised functionality or update SKILL.md to reflect that core features are unimplemented.
 kg_builder/extractor.py, kg_builder/relation.py, kg_builder/search.py
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned kg_builder/extractor.py:64 — open(file_path, 'r')
Network READ NONE ✓ Aligned No network calls in any Python file; external URLs are only in docs/visualizer H…
Shell NONE NONE — skill.sh uses only echo/logging; no subprocess, curl, wget, or exec calls
Environment NONE NONE — config/config.json reads NEO4J_PASSWORD and OLLAMA_BASE_URL from env, but only a…
Skill Invoke NONE NONE — No skill-to-skill invocation
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser automation
Database WRITE WRITE ✓ Aligned storage/sqlite_store.py:53-73 — INSERT OR REPLACE INTO entities/relations tables
2 findings
🔗
Medium External URL 外部 URL
https://clawhub.com
README.md:165
🔗
Medium External URL 外部 URL
https://d3js.org/d3.v7.min.js
kg_builder/visualizer.py:35

File Tree

19 files · 41.4 KB · 1508 lines
Python 12f · 960L Markdown 2f · 291L Shell 1f · 186L JSON 3f · 69L Text 1f · 2L
├─ ▾ 📁 config
│ └─ 🔑 config.json ⚠ JSON 39L · 926 B
├─ ▾ 📁 kg_builder
│ ├─ 🐍 __init__.py Python 24L · 560 B
│ ├─ 🐍 extractor.py Python 112L · 3.5 KB
│ ├─ 🐍 graph.py Python 114L · 3.1 KB
│ ├─ 🐍 relation.py Python 132L · 4.2 KB
│ ├─ 🐍 search.py Python 102L · 2.8 KB
│ └─ 🐍 visualizer.py Python 71L · 2.0 KB
├─ ▾ 📁 storage
│ └─ 🐍 sqlite_store.py Python 160L · 5.2 KB
├─ ▾ 📁 tests
│ ├─ 🐍 __init__.py Python 1L · 16 B
│ ├─ 🐍 run_tests.py Python 38L · 953 B
│ ├─ 🐍 test_extractor.py Python 57L · 1.5 KB
│ ├─ 🐍 test_graph.py Python 65L · 1.8 KB
│ └─ 🐍 test_relation.py Python 84L · 2.7 KB
├─ 📋 _meta.json JSON 5L · 142 B
├─ 📋 package.json JSON 25L · 606 B
├─ 📝 README.md Markdown 170L · 3.5 KB
├─ 📄 requirements.txt Text 2L · 27 B
├─ 📝 SKILL.md Markdown 121L · 2.5 KB
└─ 🔧 skill.sh Shell 186L · 5.4 KB

Dependencies 2 items

PackageVersionSourceKnown VulnsNotes
spacy >=3.5.0 pip No Lower bound only, no upper cap
networkx >=3.0 pip No Lower bound only, no upper cap

Security Positives

✓ No credential harvesting or environment variable exfiltration detected
✓ No subprocess, shell execution, or command injection vulnerabilities
✓ No base64-encoded payloads, eval(), or dynamic code execution
✓ No data exfiltration or C2 communication channels
✓ No obfuscation or anti-analysis techniques
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)
✓ No supply_chain typosquatting or malicious dependency indicators
✓ SQLiteStorage uses parameterized queries (no SQL injection risk)
✓ Neo4j and Ollama credentials are read-only config template values, not exfiltrated