中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：21 小时前 重新扫描
15 /100
ai-intelligent-budget-management
企业预算编制与执行跟踪，智能预警
This skill package contains only documentation/metadata with no implementation code, making it a placeholder or incomplete skill with minimal security surface.
技能名称ai-intelligent-budget-management
分析耗时28.6s
引擎pi
✓
可以安装
This skill cannot be evaluated for runtime security as it contains no executable code. If this is intended as a functional skill, implementation scripts must be added before deployment.

安全发现 2 项

严重性 安全发现 位置
低危
Incomplete Skill Package 文档欺骗
SKILL.md references a git repository and execution commands but no actual implementation code exists in this package. The skill appears to be a placeholder or incomplete submission.
git clone https://github.com/openclaw-skills/ai-intelligent-budget-management
→ If this is a functional skill, include the actual Python/JS implementation files, requirements.txt, and app.py as referenced in the documentation.
 SKILL.md:26
低危
No allowed-tools Declaration 权限提升
The skill.json does not declare required permissions or allowed-tools mapping, making it impossible to determine what system resources this skill intends to access.
{...}
→ Add an allowed-tools section mapping required permissions (e.g., filesystem:READ, shell:WRITE) to enable proper security review.
 skill.json:1
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No code files present to analyze
网络访问 NONE NONE — No code files present to analyze
命令执行 NONE NONE — No code files present to analyze
环境变量 NONE NONE — No code files present to analyze
技能调用 NONE NONE — No code files present to analyze
剪贴板 NONE NONE — No code files present to analyze
浏览器 NONE NONE — No code files present to analyze
数据库 NONE NONE — No code files present to analyze

目录结构

2 文件 · 1.3 KB · 62 行
Markdown 1f · 51L JSON 1f · 11L
├─ 📋 skill.json JSON 11L · 319 B
└─ 📝 SKILL.md Markdown 51L · 1.0 KB

安全亮点

✓ No malicious code present - skill contains no executable files
✓ No sensitive file access detected
✓ No network communication code present
✓ No credential harvesting code present
✓ No obfuscation techniques observed
✓ No supply chain dependencies to audit