中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 20/100
上次扫描：20 小时前 重新扫描
20 /100
face-swap
Guide users to VideoAny Face Swap tool to create AI face swap videos
This is a legitimate face swap guidance skill that prints formatted instructions directing users to an external web service. The shell:exec permission is declared but not actually used by any script, representing minor over-declaration.
技能名称face-swap
分析耗时21.4s
引擎pi
✓
可以安装
Consider removing the undeclared shell:exec permission if subprocess execution is not required. The skill would function identically with filesystem:READ only (for potential config files).

安全发现 1 项

严重性 安全发现 位置
低危
Over-declared shell permission 文档欺骗
SKILL.md declares 'permissions: shell:exec' but no script uses subprocess, os.system, or any shell execution. The declared permission is not utilized.
permissions:
  - shell:exec
→ Remove the shell:exec permission declaration since no script executes shell commands. Use filesystem:READ if config file reading is needed in the future.
 SKILL.md:3
资源类型声明权限推断权限状态证据
命令执行 ADMIN NONE ✓ 一致 SKILL.md declares shell:exec, but guide_face_swap.py only uses argparse and prin…
文件系统 NONE NONE — No file operations in any script
网络访问 NONE NONE — No HTTP requests made
2 项发现
🔗
中危 外部 URL 外部 URL
https://videoany.io/face-swap
SKILL.md:14
🔗
中危 外部 URL 外部 URL
https://videoany.io/face-swap.
clawhub.json:4

目录结构

8 文件 · 8.2 KB · 262 行
Python 4f · 184L Markdown 1f · 59L JSON 2f · 18L Text 1f · 1L
├─ ▾ 📁 scripts
│ ├─ 🐍 convert_image_to_svg.py Python 16L · 351 B
│ ├─ 🐍 convert_svg.py Python 16L · 351 B
│ ├─ 🐍 guide_face_swap.py Python 136L · 4.6 KB
│ └─ 🐍 guide_image_to_video.py Python 16L · 351 B
├─ 📋 _meta.json JSON 6L · 129 B
├─ 📋 clawhub.json JSON 12L · 689 B
├─ 📄 requirements.txt Text 1L · 44 B
└─ 📝 SKILL.md Markdown 59L · 1.8 KB

安全亮点

✓ No credential harvesting - no access to environment variables or sensitive paths
✓ No data exfiltration - no network requests or data transmission
✓ No obfuscation - all code is plain text Python
✓ No dependencies required - requirements.txt is empty
✓ Pure guidance tool with no side effects beyond printing text
✓ Includes responsible-use reminders for face swap ethics
✓ Backward-compatible wrappers are benign pass-through imports