中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：2 天前 重新扫描
5 /100
jiuma-free-meta-human
九马AI免费数字人视频生成技能
A legitimate digital human video generation skill using the Jiuma AI platform. All functionality is declared in documentation, no hidden behavior detected, and credential handling is appropriate for the service.
技能名称jiuma-free-meta-human
分析耗时31.3s
引擎pi
✓
可以安装
This skill is safe to use. Consider pinning the requests library version for better dependency hygiene.

安全发现 1 项

严重性 安全发现 位置
低危
Unpinned requests dependency
The requests library in generate_video.py and utils.py does not specify a version constraint. While requests is a well-maintained library with no currently known vulnerabilities, version pinning is a security best practice.
import requests
→ Add version pinning: requests>=2.28.0
 generate_video.py:14
资源类型声明权限推断权限状态证据
文件系统 WRITE WRITE ✓ 一致 utils.py:11 - creates .jiuma directory and saves API key
网络访问 READ READ ✓ 一致 generate_video.py:23, login.py:6-7 - calls api.jiuma.com API
命令执行 NONE NONE — No shell execution detected
环境变量 NONE NONE — No environment variable access
5 项发现
🔗
中危 外部 URL 外部 URL
https://.../qrcode.png
LOGIN.md:41
🔗
中危 外部 URL 外部 URL
https://.../login
LOGIN.md:42
🔗
中危 外部 URL 外部 URL
https://api.jiuma.com
generate_video.py:23
🔗
中危 外部 URL 外部 URL
https://api.jiuma.com/user/getLoginQrcode
login.py:6
🔗
中危 外部 URL 外部 URL
https://api.jiuma.com/user/checkLoginStatus
login.py:7

目录结构

7 文件 · 19.0 KB · 596 行
Python 3f · 285L Markdown 2f · 267L JSON 2f · 44L
├─ 🐍 generate_video.py Python 155L · 5.5 KB
├─ 📝 LOGIN.md Markdown 105L · 3.2 KB
├─ 🐍 login.py Python 52L · 1.6 KB
├─ 📋 meta-human.json JSON 33L · 491 B
├─ 📝 SKILL.md Markdown 162L · 5.7 KB
├─ 🐍 utils.py Python 78L · 2.3 KB
└─ 📋 voice.json JSON 11L · 200 B

依赖分析 1 项

包名版本来源已知漏洞备注
requests * pip 否 Version not pinned

安全亮点

✓ All functionality declared in SKILL.md with clear parameter documentation
✓ Network calls only to legitimate service endpoint (api.jiuma.com)
✓ No base64-encoded commands or obfuscated code
✓ No subprocess/shell execution - uses only standard Python libraries
✓ No access to sensitive system paths (~/.ssh, ~/.aws, etc.)
✓ API key storage location and purpose clearly documented in LOGIN.md
✓ No credential exfiltration or data theft indicators
✓ Uses standard argparse for CLI - no suspicious command construction
✓ No hidden HTML comments or steganographic payloads