中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：21 小时前 重新扫描
15 /100
rynjer-image-generation
Agent-first marketing image generation skill with prompt rewrite, cost estimation, and image generation via Rynjer API
A legitimate image generation skill for agents with no malicious behavior; only minor documentation and version pinning issues detected.
技能名称rynjer-image-generation
分析耗时45.3s
引擎pi
✓
可以安装
Safe to use. Consider pinning package.json version and replacing the example credential placeholder in README.md with a clearer placeholder format.

安全发现 2 项

严重性 安全发现 位置
低危
Example credential placeholder in README 文档欺骗
README.md line 33 shows 'ACCESS_TOKEN="your_access_token_or_ryn_agent_v1_key"' as a usage example. This is clearly a placeholder with 'your_' prefix and no actual credential is exposed.
export RYNJER_ACCESS_TOKEN="your_access_token_or_ryn_agent_v1_key"
→ Consider using a more obvious placeholder format like 'REPLACE_WITH_YOUR_TOKEN' to avoid confusion.
 README.md:33
低危
package.json version not formally pinned 供应链
package.json has version 0.1.0 but the package has no external dependencies (only Node.js built-ins), so there is no supply chain risk.
"version": "0.1.0"
→ No action needed; no external dependencies exist.
 package.json:1
资源类型声明权限推断权限状态证据
网络访问 READ READ ✓ 一致 src/mock-runtime.js:9-27 makes HTTPS requests to rynjer.com API
文件系统 READ READ ✓ 一致 src/mock-runtime.js:5-6 reads tools.json and templates.json
命令执行 NONE NONE — No shell execution found in codebase
环境变量 READ READ ✓ 一致 src/mock-runtime.js:7-8 reads RYNJER_ACCESS_TOKEN, RYNJER_USE_LIVE, RYNJER_BASE_…
技能调用 READ READ ✓ 一致 Skill exposes 5 tools: rewrite_image_prompt, estimate_image_cost, generate_image…
剪贴板 NONE NONE — No clipboard access detected
浏览器 NONE NONE — No browser automation detected
数据库 NONE NONE — No database access detected
1 高危 2 项发现
🔑
高危 API 密钥 疑似硬编码凭证
ACCESS_TOKEN="your_access_token_or_ryn_agent_v1_key"
README.md:33
🔗
中危 外部 URL 外部 URL
https://rynjer.com
README.md:32

目录结构

14 文件 · 44.7 KB · 1590 行
Markdown 9f · 893L JavaScript 1f · 436L JSON 4f · 261L
├─ ▾ 📁 examples
│ └─ 📋 happy-path.json JSON 32L · 963 B
├─ ▾ 📁 src
│ ├─ 📜 mock-runtime.js JavaScript 436L · 13.4 KB
│ ├─ 📋 templates.json JSON 78L · 2.6 KB
│ └─ 📋 tools.json JSON 136L · 5.0 KB
├─ ▾ 📁 templates
│ ├─ 📝 monetization-boundary.md Markdown 17L · 440 B
│ ├─ 📝 routing-policy.md Markdown 22L · 692 B
│ └─ 📝 use-cases.md Markdown 16L · 554 B
├─ 📝 CHANGELOG.md Markdown 20L · 912 B
├─ 📝 IMPLEMENTATION.md Markdown 168L · 3.9 KB
├─ 📋 package.json JSON 15L · 361 B
├─ 📝 PUBLISH.md Markdown 37L · 1.2 KB
├─ 📝 README.md Markdown 248L · 5.6 KB
├─ 📝 SCHEMA.md Markdown 125L · 2.4 KB
└─ 📝 SKILL.md Markdown 240L · 6.8 KB

依赖分析 1 项

包名版本来源已知漏洞备注
none N/A builtin 否 Only uses Node.js built-in modules: https, fs, path - no external dependencies

安全亮点

✓ No shell execution or command injection vulnerabilities detected
✓ No credential harvesting or environment variable enumeration for exfiltration
✓ No base64 decoding, eval(), or obfuscated code execution
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env, etc.)
✓ No C2 communication or data exfiltration patterns
✓ Uses only Node.js built-in modules (https, fs, path) - no supply chain risk
✓ API authentication uses Bearer token pattern for legitimate API calls only
✓ All capabilities are declared and aligned with documented behavior
✓ Skill uses mock mode by default, requiring explicit opt-in for live API calls
✓ No hidden functionality or undocumented behavior detected