中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 25/100
Last scan:22 hr ago Rescan
25 /100
file-download-server
快速搭建临时文件下载服务器，支持HTTP下载、美观的下载页面、防火墙端口自动开放
A legitimate HTTP file download server with hardcoded IP address in documentation but no malicious code or hidden behavior detected.
Skill Namefile-download-server
Duration48.8s
Enginepi
✓
Safe to install
Remove the hardcoded IP address (81.70.47.140) from QUICKSTART.md and replace with a placeholder. Otherwise, the skill's functionality is straightforward and its capabilities are properly documented.

Findings 3 items

Severity Finding Location
Medium
Hardcoded IP address in documentation Doc Mismatch
references/QUICKSTART.md contains a hardcoded IP address 81.70.47.140 as an example download URL. While this appears to be a tutorial example, it raises questions about whether the author tested this skill against their own infrastructure. No code in any script actually connects to this IP.
print("📥 请访问: http://81.70.47.140:4000/")
→ Replace the hardcoded IP with a placeholder like 'YOUR_SERVER_IP' in the documentation to avoid implying a fixed remote endpoint.
 references/QUICKSTART.md:57
Low
Undeclared shell WRITE for iptables Priv Escalation
Both open_port.py and start_server.py execute iptables commands via subprocess with root privileges. This shell:WRITE capability is not explicitly declared in the SKILL.md capability section, though it is mentioned in the script parameter descriptions.
subprocess.run(["iptables", "-I", "INPUT", "-p", "tcp", "--dport", str(port), "-j", "ACCEPT"])
→ Add 'shell: WRITE' to the declared allowed-tools mapping and clarify that iptables requires root/sudo privileges.
 scripts/open_port.py:25
Low
os.chdir() modifies process working directory Priv Escalation
start_server.py calls os.chdir(args.directory) which changes the process working directory. This is a filesystem WRITE-level side effect not explicitly declared.
os.chdir(args.directory)
→ Document that the server changes its working directory to the shared folder.
 scripts/start_server.py:38
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned os.path.isdir/isfile checks, os.listdir for directory listing
Filesystem NONE WRITE ✓ Aligned generate_index.py writes HTML files; start_server.py calls os.chdir()
Shell NONE WRITE ✓ Aligned open_port.py:25 subprocess.run iptables; start_server.py:49,71 subprocess calls
Network READ READ ✓ Aligned http.server serves files on TCP port (inbound), no outbound network calls except…
Environment NONE NONE — No access to os.environ for credentials
1 High 5 findings
📡
High IP Address 硬编码 IP 地址
81.70.47.140
references/QUICKSTART.md:57
🔗
Medium External URL 外部 URL
http://your-server-ip:4000/
SKILL.md:74
🔗
Medium External URL 外部 URL
http://your-ip:8080/
SKILL.md:83
🔗
Medium External URL 外部 URL
https://netfilter.org/projects/iptables/
SKILL.md:210
🔗
Medium External URL 外部 URL
http://81.70.47.140:4000/
references/QUICKSTART.md:57

File Tree

6 files · 18.5 KB · 682 lines
Python 3f · 347L Markdown 2f · 330L JSON 1f · 5L
├─ ▾ 📁 references
│ └─ 📝 QUICKSTART.md Markdown 120L · 2.7 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 generate_index.py Python 216L · 6.5 KB
│ ├─ 🐍 open_port.py Python 45L · 1.3 KB
│ └─ 🐍 start_server.py Python 86L · 2.7 KB
├─ 📋 _meta.json JSON 5L · 139 B
└─ 📝 SKILL.md Markdown 210L · 5.2 KB

Security Positives

✓ No obfuscation detected — all code is plain, readable Python
✓ No credential theft or environment variable enumeration
✓ No base64, eval, or anti-analysis techniques
✓ No external dependencies — uses only Python standard library (no supply chain risk)
✓ All core functionality (HTTP server, HTML generation, firewall config) is declared in SKILL.md
✓ No network exfiltration or C2 communication in code
✓ Server binds to 0.0.0.0 (standard for file serving) and serves only the specified directory
✓ Download links in SKILL.md use placeholders (your-server-ip) rather than hardcoded IPs