中文 EN
Start Review
Skill Trust Decision

web-scout

纯文档型技能，仅提供使用指南，无代码文件可审查，存在供应链风险和影子功能风险但证据不足

Install decision first Source: ClawHub Scanned: Apr 30, 2026
Files 1
Artifacts 2
Violations 0
Findings 3

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review
Hidden execution and egress

2 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

What drove the risk score up

无代码文件审查 +10

只有 SKILL.md 文档，无法验证实际代码行为，影子功能风险未知

供应链风险 +10

pip install 直接从 GitHub 主分支安装，无版本锁定

声明权限与实际不符 +5

声明需要 exec 工具，但实际只是文档指导用户执行 shell 命令

Most important evidence

Medium Supply Chain

第三方 GitHub 依赖无版本锁定

pip install 直接从 GitHub 主分支安装 agent-reach 库，无法保证代码稳定性或历史版本回溯

SKILL.md:41
使用 PyPI 官方包或锁定具体 commit hash
Low Doc Mismatch

影子功能风险无法排除

无代码文件，仅文档说明，实际 agent-reach 库代码行为未知

SKILL.md:1
审查 agent-reach 源码后再部署
Low Credential Theft

Cookie 配置存储本地但风险未知

文档声称 Cookie 仅存 ~/.agent-reach/config.yaml 但无代码验证

SKILL.md:149
确认实际代码不会将凭证外传

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred NONE
SKILL.md 无代码，文档仅描述用户执行命令
Shell Pass
Declared WRITE
→
Inferred WRITE
SKILL.md:41 描述通过 exec 工具执行 bash 命令
Network Pass
Declared READ
→
Inferred READ
SKILL.md:69-91 描述网页采集和 API 调用

Suspicious artifacts and egress

Medium External URL
https://chromewebstore.google.com/detail/cookie-editor/hlkenndednhfkekhgcdicdfddnkalmdm

SKILL.md:69

Medium External URL
https://r.jina.ai/URL

SKILL.md:91

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
agent-reach main branch (unpinned) GitHub No 直接安装 GitHub 主分支，无版本锁定

File composition

1 files · 171 lines
Markdown 1 files · 171 lines
Files of concern · 1
SKILL.md Markdown · 171 lines
第三方 GitHub 依赖无版本锁定 · 影子功能风险无法排除 · Cookie 配置存储本地但风险未知 · https://chromewebstore.google.com/detail/cookie-editor/hlkenndednhfkekhgcdicdfddnkalmdm · https://r.jina.ai/URL

Security positives

文档清晰完整，声明了权限用途
提供了 --safe 和 --dry-run 模式供安全检查
Cookie 配置明确说明存本地
MIT 协议开源可审查（需访问外部仓库）
无需 API Key，零费用模式