scnet-chat 安全扫描报告 — 可信 | ClawSafe

5 /100

scnet-chat

SCNet 超算平台管理工具 - 缓存管理、区域切换、用户信息查询、作业管理和文件管理

This is a legitimate Python CLI tool for managing the SCNet supercomputing platform. All functionality is well-documented, subprocess calls execute only internal project scripts, network requests target only official SCNet API endpoints, and there are no signs of credential harvesting, data exfiltration, or malicious behavior.

技能名称scnet-chat

分析耗时36.9s

引擎pi

✓

可以安装

This skill is safe to use. Consider pinning aiohttp to a specific version in production environments for better dependency stability.

安全发现 3 项

严重性	安全发现	位置
低危	Shell execution declared in SECURITY.md but not SKILL.md subprocess.run is used internally but only for calling project scripts (scripts/job.py, scripts/user.py, etc.), not arbitrary shell commands. This is documented in SECURITY.md. `subprocess.run(['python', str(scripts/job.py), ...])` → Consider adding subprocess usage to SKILL.md for transparency, though usage is legitimate	`SKILL.md:1`
低危	aiohttp dependency not version pinned requirements.txt is not present and aiohttp is installed without version constraints. While this is acceptable for optional performance enhancement, pinning versions is best practice. `pip install aiohttp` → Consider using pip install aiohttp>=3.7.0 for better reproducibility	`SKILL.md:100`
提示	Comprehensive SECURITY.md documentation The project includes detailed security documentation explaining all potentially suspicious code patterns (subprocess, base64, network requests) with legitimate justifications. `Security documentation exists with full explanations` → No action needed - this is a positive security indicator	`SECURITY.md:1`

资源类型	声明权限	推断权限	状态	证据
文件系统	`READ`	`READ`	✓ 一致	SKILL.md declares config and cache file access
网络访问	`READ`	`READ`	✓ 一致	All requests to api.scnet.cn and www.scnet.cn APIs
命令执行	`NONE`	`WRITE`	✓ 一致	subprocess used internally for script invocation (legitimate)

16 项发现

🔗

中危外部 URL 外部 URL

https://api.scnet.cn

SECURITY.md:57

🔗

中危外部 URL 外部 URL

https://www.scnet.cn

SECURITY.md:58

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/

SECURITY.md:144

🔗

中危外部 URL 外部 URL

https://tools.ietf.org/html/rfc7519

SECURITY.md:145

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ui/console/index.html#/personal/auth-manage

SKILL.md:84

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/2.0/api/jobmanager/job.html

SKILL.md:238

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/2.0/api/safecertification/get-user-tokens-aksk.html

scripts/cache.py:295

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/2.0/api/safecertification/get-center-info.html

scripts/cache.py:335

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/2.0/api/jobmanager/list-cluster.html

scripts/cache.py:350

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/2.0/api/jobmanager/query-user-queue.html

scripts/cache.py:365

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/2.0/api/userresource/get-common-user.html

scripts/cache.py:380

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/2.0/api/jobmanager/query-user-quota.html

scripts/cache.py:395

🔗

中危外部 URL 外部 URL

https://www.scnet.cn/ac/openapi/doc/2.0/api/jobmanager/query-used-time.html

scripts/cache.py:411

🔗

中危外部 URL 外部 URL

https://ksefile.hpccube.com:65241/efile

scripts/cache.py:657

🔗

中危外部 URL 外部 URL

https://ksefile.hpccube.com:65241

scripts/cache.py:657

🔗

中危外部 URL 外部 URL

https://ksefile.hpccube.com:65241/

scripts/cache.py:658

目录结构

11 文件 · 266.3 KB · 7099 行

Python 8f · 6400L Markdown 2f · 677L Env 1f · 22L

├─ ▾ 📁 scripts

│ ├─ 🐍 cache.py Python 1380L · 54.6 KB

│ ├─ 🐍 compat.py Python 41L · 1.3 KB

│ ├─ 📄 config.example.env Env 22L · 510 B

│ ├─ 🐍 config.py Python 164L · 5.4 KB

│ ├─ 🐍 file.py Python 821L · 30.1 KB

│ ├─ 🐍 job.py Python 1634L · 63.7 KB

│ ├─ 🐍 user.py Python 829L · 28.4 KB

│ └─ 🐍 utils.py Python 260L · 7.7 KB

├─ 🐍 scnet.py Python 1271L · 49.9 KB

├─ 📝 SECURITY.md Markdown 146L · 4.1 KB

└─ 📝 SKILL.md Markdown 531L · 20.8 KB

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`aiohttp`	`>=3.7.0`	pip	否	Optional dependency for async performance; not version pinned

安全亮点

✓ All functionality is clearly documented in SKILL.md with extensive usage examples

✓ SECURITY.md provides comprehensive explanations for potentially suspicious code patterns

✓ Network requests are limited to official SCNet API domains (api.scnet.cn, www.scnet.cn)

✓ subprocess calls execute only internal project scripts, never user-provided commands

✓ No access to sensitive system directories (~/.ssh, ~/.aws, /etc/passwd, etc.)

✓ No evidence of data exfiltration, credential harvesting, or C2 communication

✓ No obfuscation, steganography, or hidden payloads detected

✓ Code is open source and well-structured

✓ JWT token decoding is standard practice for API authentication