GitLab Daily Report Skill 安全扫描报告 — 可信 | ClawSafe

5 /100

GitLab Daily Report Skill

AI assistant for GitLab project data analysis and Feishu report generation

GitLab Daily Report skill is a legitimate reporting tool that fetches GitLab data and sends formatted reports to Feishu. No malicious behavior detected.

技能名称GitLab Daily Report Skill

分析耗时30.3s

引擎pi

✓

可以安装

This skill is safe to use. Standard security hygiene: ensure config.json is protected, use minimal-privilege GitLab tokens, and restrict Feishu webhook access.

安全发现 1 项

严重性	安全发现	位置
低危	SSL certificate verification disabled 敏感访问 Script disables SSL verification (ssl.CERT_NONE) to support self-signed GitLab certificates. This is documented and necessary for internal GitLab instances with self-signed certs. `_SSL_CTX.verify_mode = ssl.CERT_NONE` → Consider adding config option to enable SSL verification for production environments with valid certificates.	`scripts/gitlab_report.py:19`

资源类型	声明权限	推断权限	状态	证据
文件系统	`READ`	`READ`	✓ 一致	SKILL.md declares config.json reading
网络访问	`WRITE`	`WRITE`	✓ 一致	GitLab API reads and Feishu webhook writes are documented
命令执行	`READ`	`READ`	✓ 一致	Runs python scripts for data fetching
环境变量	`NONE`	`READ`	✓ 一致	Reads gitlab_token from config.json, not os.environ

3 项发现

🔗

中危外部 URL 外部 URL

https://gitlab.yourcompany.com

references/README.md:29

🔗

中危外部 URL 外部 URL

https://your-server.com/webhook

references/README.md:114

🔗

中危外部 URL 外部 URL

https://open.feishu.cn/open-apis/bot/v2/hook/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

scripts/config.example.json:11

目录结构

5 文件 · 41.3 KB · 1116 行

Python 2f · 729L Markdown 2f · 372L JSON 1f · 15L

├─ ▾ 📁 references

│ └─ 📝 README.md Markdown 188L · 5.4 KB

├─ ▾ 📁 scripts

│ ├─ 📋 config.example.json JSON 15L · 327 B

│ ├─ 🐍 example.py Python 19L · 616 B

│ └─ 🐍 gitlab_report.py Python 710L · 28.3 KB

└─ 📝 SKILL.md Markdown 184L · 6.6 KB

安全亮点

✓ No credential harvesting beyond GitLab API token required for functionality

✓ No data exfiltration - only sends report data to configured Feishu webhook

✓ No obfuscation or base64-encoded payloads detected

✓ No suspicious network connections to unknown IPs

✓ Documentation accurately describes all functionality

✓ Uses only Python standard library (no external dependencies with vulnerabilities)

✓ No sensitive file access (no ~/.ssh, ~/.aws, .env reading)

✓ Proper two-step confirmation flow prevents accidental data push

✓ ThreadPoolExecutor used for legitimate concurrent API requests