Scan Report
0 /100
super-train
火车票智能中转方案推荐助手
This is a legitimate train ticket booking assistant skill with no security concerns. It only stores user preferences/history in local JSON files and invokes the flyai-cli tool for train queries.
Safe to install
This skill is safe to use. No security actions required.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | WRITE | WRITE | ✓ Aligned | SKILL.md:assets/preferences.json and assets/history.json are declared for read/w… |
| Network | NONE | NONE | — | All network access is delegated to flyai-cli tool, not performed directly |
| Shell | NONE | NONE | — | No shell commands executed; only invokes flyai-cli tool |
| Environment | NONE | NONE | — | No environment variable access observed |
| Database | NONE | NONE | — | No database access |
File Tree
4 files · 15.3 KB · 375 lines Markdown 2f · 359L
JSON 2f · 16L
├─
▾
assets
│ ├─
history.json
JSON
│ └─
preferences.json
JSON
├─
▾
references
│ └─
flyai-cli-reference.md
Markdown
└─
SKILL.md
Markdown
Security Positives
✓ No shell execution or subprocess calls detected
✓ No sensitive path access (~/.ssh, ~/.aws, .env)
✓ No credential harvesting or environment variable enumeration
✓ No base64 encoded commands or obfuscated code
✓ No hidden functionality - SKILL.md comprehensively documents all behavior
✓ Only stores user preferences and history in local JSON files
✓ Network access delegated entirely to externally-installed flyai-cli tool
✓ No download/install of external scripts or tools
✓ No data exfiltration behavior