中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:21 hr ago Rescan
15 /100
upload-skill
Create and manage test payment links (one-time, recurring, payment plans, multiple products, custom plans, pay-what-you-want).
A test payment link creation skill with minor documentation inconsistencies but no malicious behavior observed.
Skill Nameupload-skill
Duration31.3s
Enginepi
✓
Safe to install
Fix the hardcoded API key to use the declared TEST_API_KEY environment variable for consistency. No security action required beyond documentation alignment.

Findings 3 items

Severity Finding Location
Low
Hardcoded credential instead of declared environment variable Doc Mismatch
SKILL.md metadata declares TEST_API_KEY as an environment variable requirement, but the implementation in test-scrpt.js line 2 hardcodes API_KEY='abc'. This is a minor inconsistency in a test/sandbox skill context.
const API_KEY = 'abc';
→ Change to: const API_KEY = process.env.TEST_API_KEY || '';
 scripts/test-scrpt.js:2
Low
Extensive validation rules in SKILL.md not implemented Doc Mismatch
SKILL.md sections 2-14 contain extensive validation, security, error handling, webhook, and testing rules that are not implemented in the actual script. This creates documentation-code mismatch but poses no security risk for a test skill.
Sections 2-14 describe validation, security rules, and advanced features
→ Either implement the documented rules or simplify SKILL.md to match actual functionality
 SKILL.md:1
Info
Localhost-only network communication Sensitive Access
The script only communicates with localhost:4000, indicating a local test environment with no external network exposure.
BASE = 'http://localhost:4000/v1'
→ This is acceptable for a test skill but ensure production variants use HTTPS
 scripts/test-scrpt.js:4
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file operations in test-scrpt.js
Network READ READ ✓ Aligned test-scrpt.js:18 uses fetch to localhost:4000
Shell NONE NONE — No shell/subprocess execution found
Environment READ NONE ✓ Aligned SKILL.md declares TEST_API_KEY env but test-scrpt.js:2 hardcodes 'abc'
Skill Invoke NONE NONE — No skill invocation detected
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser automation
Database NONE NONE — No database operations
1 findings
🔗
Medium External URL 外部 URL
https://test.com
SKILL.md:9

File Tree

2 files · 7.3 KB · 308 lines
Markdown 1f · 229L JavaScript 1f · 79L
├─ ▾ 📁 scripts
│ └─ 📜 test-scrpt.js JavaScript 79L · 2.0 KB
└─ 📝 SKILL.md Markdown 229L · 5.3 KB

Security Positives

✓ No shell execution or command injection vectors
✓ No credential harvesting or exfiltration mechanisms
✓ No obfuscation or anti-analysis techniques
✓ No access to sensitive filesystem paths (~/.ssh, ~/.aws, .env)
✓ No base64-encoded payloads or eval usage
✓ No remote script execution (curl|bash, wget|sh)
✓ No supply chain risks - only uses Node.js built-in fetch
✓ Localhost-only network traffic prevents data exfiltration
✓ Input validation present for required fields