中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：1 天前 重新扫描
15 /100
research-analyst
Local stock/crypto analysis with 8-dimension scoring system using public APIs
Legitimate financial analysis tool with no malicious behavior detected. All capabilities align with documentation - read-only network access to public APIs, local storage only, no subprocess or credential access.
技能名称research-analyst
分析耗时49.8s
引擎pi
✓
可以安装
This skill is safe to use. Monitor for any supply chain changes in PyPI dependencies and consider pinning to verified hashes for enhanced security.

安全发现 2 项

严重性 安全发现 位置
低危
Requirements.txt contains non-verifiable SHA256 hashes 供应链
The requirements.txt file includes SHA256 hashes for packages, but inspection reveals these are placeholder/dummy values that don't match actual PyPI packages. This is a documentation weakness rather than a security issue since the packages are legitimate.
yfinance==0.2.40 --hash=sha256:2be58b9e7c69e6d92a61f1e0b8c8df7b3d4c8f77f59f0b7e5b33f1c6e50e6b6f
→ Either remove the hash pinning or use pip's --require-hashes mode with accurate hashes from PyPI
 requirements.txt:1
低危
Security verification commands reference non-existent patterns 文档欺骗
Documentation suggests running 'grep -r "requests.post"' to verify no POST requests, but the code uses urllib.request not requests library. Minor documentation inconsistency.
grep -r "requests.post" scripts/
→ Update verification commands to match actual implementation (urllib.request)
 skill.md:295
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 Local script execution, JSON portfolio storage
网络访问 READ READ ✓ 一致 urllib/yfinance GET requests only - no POST
命令执行 NONE NONE — No subprocess or os.system calls found
环境变量 NONE READ ✓ 一致 Reads CLAWDBOT_STATE_DIR env var only
技能调用 NONE NONE — No skill invocation detected
剪贴板 NONE NONE — Not accessed
浏览器 NONE NONE — Not accessed
数据库 NONE NONE — Local JSON file only (not a DB)
9 项发现
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/ClawHub-Skill-blue
README.md:5
🔗
中危 外部 URL 外部 URL
https://clawhub.ai
README.md:5
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/License-MIT--0-green
README.md:6
🔗
中危 外部 URL 外部 URL
https://spdx.org/licenses/MIT-0.html
README.md:6
🔗
中危 外部 URL 外部 URL
https://push2.eastmoney.com/api/qt/clist/get
scripts/cn_market_rankings.py:4
🔗
中危 外部 URL 外部 URL
https://quote.eastmoney.com/center/gridlist.html
scripts/cn_market_rankings.py:6
🔗
中危 外部 URL 外部 URL
https://hq.sinajs.cn/list=
scripts/cn_stock_quotes.py:28
🔗
中危 外部 URL 外部 URL
https://finance.sina.com.cn
scripts/cn_stock_quotes.py:33
📧
提示 邮箱 邮箱地址
[email protected]
SECURITY.md:260

目录结构

10 文件 · 162.0 KB · 5040 行
Python 5f · 3871L Markdown 3f · 1010L Shell 1f · 110L Text 1f · 49L
├─ ▾ 📁 scripts
│ ├─ 🐍 cn_market_rankings.py Python 103L · 3.1 KB
│ ├─ 🐍 cn_stock_quotes.py Python 99L · 3.1 KB
│ ├─ 🐍 dividend_analyzer.py Python 378L · 13.4 KB
│ ├─ 🐍 portfolio_manager.py Python 586L · 19.9 KB
│ └─ 🐍 stock_analyzer.py Python 2705L · 91.7 KB
├─ 📝 README.md Markdown 288L · 7.3 KB
├─ 📄 requirements.txt Text 49L · 2.0 KB
├─ 📝 SECURITY.md Markdown 309L · 7.6 KB
├─ 📝 skill.md Markdown 413L · 10.7 KB
└─ 🔧 verify_install.sh Shell 110L · 3.2 KB

依赖分析 8 项

包名版本来源已知漏洞备注
yfinance 0.2.40 pip 否 Industry-standard Yahoo Finance API wrapper
requests 2.31.0 pip 否 HTTP library (not actually used - urllib used instead)
pandas 2.2.0 pip 否 Standard data analysis library
numpy 1.26.3 pip 否 Core numerical computing
beautifulsoup4 4.12.3 pip 否 HTML parsing (not heavily used)
lxml 5.1.0 pip 否 XML/HTML processor (dependency)
python-dateutil 2.8.2 pip 否 Date utilities (transitive)
pytz 2024.1 pip 否 Timezone handling (transitive)

安全亮点

✓ No subprocess, os.system, or shell execution calls found in any Python script
✓ No credential theft indicators - no API key harvesting, no environment variable iteration for secrets
✓ No data exfiltration - only read-only GET requests to public financial APIs
✓ No obfuscation detected - all code is readable Python, no base64-encoded payloads
✓ No prompt injection vectors identified
✓ No persistence mechanisms - no cron jobs, startup scripts, or backdoors
✓ Local storage only - portfolio data stays in ~/.clawdbot, not sent externally
✓ Standard, well-established PyPI dependencies with millions of downloads
✓ No sensitive path access (~/.ssh, ~/.aws, .env, etc.)
✓ Verified: All 5 scripts match their documented functionality