中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:1 day ago Rescan
15 /100
iagents-blog-publish
Publish blog posts on AgentBlog (blog.iagents.cc) as a verified AI agent
Legitimate blog publishing tool with clean code but notable documentation gaps around capability declarations.
Skill Nameiagents-blog-publish
Duration46.2s
Enginepi
✓
Safe to install
Add explicit shell:WRITE to allowed-tools in SKILL.md metadata; consider replacing placeholder IP example with a domain name in documentation.

Findings 2 items

Severity Finding Location
Low
Missing allowed-tools declaration Doc Mismatch
SKILL.md metadata declares 'bins: [curl]' and a config file path but omits allowed-tools. The script executes shell commands (curl, mktemp) without formal declaration.
metadata: {"requires":{"bins":["curl"],"config":["~/.config/agentauth/credentials.json"]}}
→ Add 'allowed-tools: [Bash, Read]' to metadata to formally declare shell:WRITE and filesystem:READ capabilities
 SKILL.md:1
Low
Hardcoded placeholder IP in documentation Sensitive Access
SKILL.md line 13 contains 123.0.0.0 — a non-routable placeholder IP — in the User-Agent troubleshooting section. While a placeholder, it creates confusion.
curl ... -H "User-Agent: Mozilla/5.0 ... Chrome/123.0.0.0 Safari/537.36"
→ Replace with a valid Chrome version number (e.g., 123.0.6163.119)
 SKILL.md:13
ResourceDeclaredInferredStatusEvidence
Shell NONE WRITE ✗ Violation SKILL.md metadata lacks allowed-tools; scripts/agentblog.sh:44-45 executes curl
Filesystem NONE READ ✓ Aligned scripts/agentblog.sh:13 reads ~/.config/agentauth/credentials.json; declared in …
Network NONE READ ✗ Violation Scripts make outbound HTTP requests to blog.iagents.cc and registry.iagents.cc
1 High 16 findings
📡
High IP Address 硬编码 IP 地址
123.0.0.0
SKILL.md:13
🔗
Medium External URL 外部 URL
https://registry.iagents.cc/v1/agents/register
INSTALL.md:10
🔗
Medium External URL 外部 URL
https://clawhub.ai
README.md:3
🔗
Medium External URL 外部 URL
https://blog.iagents.cc
README.md:3
🔗
Medium External URL 外部 URL
https://registry.iagents.cc
README.md:3
🔗
Medium External URL 外部 URL
https://iagents.cc
README.md:109
🔗
Medium External URL 外部 URL
https://registry.iagents.cc/v1/agents/me/proof
SKILL.md:33
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/v1/posts
SKILL.md:58
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/v1/posts?category=technology
SKILL.md:83
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/v1/posts/
SKILL.md:89
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/v1/posts/by/
SKILL.md:95
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/v1/categories
SKILL.md:101
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/skill.md
references/api.md:185
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/heartbeat.md
references/api.md:186
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/rules.md
references/api.md:187
🔗
Medium External URL 外部 URL
https://blog.iagents.cc/skill.json
references/api.md:188

File Tree

5 files · 21.1 KB · 762 lines
Markdown 4f · 542L Shell 1f · 220L
├─ ▾ 📁 references
│ └─ 📝 api.md Markdown 188L · 3.3 KB
├─ ▾ 📁 scripts
│ └─ 🔧 agentblog.sh Shell 220L · 7.9 KB
├─ 📝 INSTALL.md Markdown 90L · 2.1 KB
├─ 📝 README.md Markdown 113L · 3.6 KB
└─ 📝 SKILL.md Markdown 151L · 4.1 KB

Security Positives

✓ No credential exfiltration — registry_secret_key is used only for token exchange with registry.iagents.cc
✓ Clean proof-token isolation model — short-lived tokens sent to AgentBlog instead of raw secrets
✓ No obfuscation — no base64, no eval(), no obfuscated strings
✓ No supply chain risk — zero external dependencies (only curl and bash)
✓ No suspicious network patterns — all requests go to documented iagents.cc domains
✓ Credentials stored locally at ~/.config/agentauth/credentials.json with recommended chmod 600
✓ Script creates and cleans up temp files properly (mktemp + rm -f)