中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：17 小时前 重新扫描
15 /100
news-summary-litiao
Fetches news from trusted international RSS feeds and can create voice summaries
A legitimate news summary skill with documented RSS feed fetching and OpenAI TTS integration. All declared capabilities align with documented behavior.
技能名称news-summary-litiao
分析耗时24.7s
引擎pi
✓
可以安装
Skill is safe to use. No action required.

安全发现 1 项

严重性 安全发现 位置
低危
Environment Variable Access 敏感访问
Skill reads OPENAI_API_KEY from environment to authenticate with OpenAI TTS API
curl -s https://api.openai.com/v1/audio/speech -H "Authorization: Bearer $OPENAI_API_KEY"
→ This is necessary for the voice summary feature and is declared in documentation. No exfiltration observed.
 SKILL.md:57
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No filesystem operations in documentation
网络访问 READ READ ✓ 一致 SKILL.md lines 17-42: RSS feed URLs declared
命令执行 NONE NONE — SKILL.md lines 45-53: curl/grep/sed are example commands, not automated executio…
环境变量 READ READ ✓ 一致 SKILL.md line 57: $OPENAI_API_KEY access declared for TTS
7 项发现
🔗
中危 外部 URL 外部 URL
https://feeds.bbci.co.uk/news/world/rss.xml
SKILL.md:17
🔗
中危 外部 URL 外部 URL
https://feeds.bbci.co.uk/news/rss.xml
SKILL.md:20
🔗
中危 外部 URL 外部 URL
https://feeds.bbci.co.uk/news/business/rss.xml
SKILL.md:23
🔗
中危 外部 URL 外部 URL
https://feeds.bbci.co.uk/news/technology/rss.xml
SKILL.md:26
🔗
中危 外部 URL 外部 URL
https://www.reutersagency.com/feed/?best-regions=world&post_type=best
SKILL.md:32
🔗
中危 外部 URL 外部 URL
https://feeds.npr.org/1001/rss.xml
SKILL.md:37
🔗
中危 外部 URL 外部 URL
https://www.aljazeera.com/xml/rss/all.xml
SKILL.md:42

目录结构

2 文件 · 2.2 KB · 109 行
Markdown 1f · 104L JSON 1f · 5L
├─ 📋 _meta.json JSON 5L · 131 B
└─ 📝 SKILL.md Markdown 104L · 2.0 KB

安全亮点

✓ No executable code or scripts present - only documentation
✓ All RSS feed URLs are from legitimate news organizations (BBC, Reuters, NPR, Al Jazeera)
✓ No base64 encoding, eval(), or obfuscation detected
✓ No credential harvesting or exfiltration patterns observed
✓ No hidden functionality or documentation mismatch
✓ No supply chain dependencies to analyze