Mobile Phone Number Undeliverable or Empty Detection 安全扫描报告 — 低风险 | ClawSafe

15 /100

Mobile Phone Number Undeliverable or Empty Detection

批量检测手机号是否空号、实号、沉默号或风险号

Legitimate phone number validation skill using a third-party API with no hidden functionality or malicious behavior.

技能名称Mobile Phone Number Undeliverable or Empty Detection

分析耗时23.5s

引擎pi

✓

可以安装

Skill is safe to use. Ensure JISU_API_KEY is properly secured and not logged in production environments.

安全发现 2 项

严重性	安全发现	位置
低危	API key placeholder in documentation SKILL.md shows 'your_appkey_here' as example, not actual credential `export JISU_API_KEY="your_appkey_here"` → This is benign - just documentation example text	`SKILL.md:23`
低危	Unsandboxed HTTP requests Script uses requests library directly without timeout configuration issues, but timeout is set to 15s `resp = requests.post(API_URL, data=data, timeout=15)` → Current implementation is acceptable for API calls	`mobileempty.py:29`

资源类型	声明权限	推断权限	状态	证据
网络访问	`READ`	`READ`	✓ 一致	mobileempty.py:29 requests.post(API_URL)
环境变量	`READ`	`READ`	✓ 一致	mobileempty.py:70 os.getenv('JISU_API_KEY')
文件系统	`NONE`	`NONE`	—	No file operations found
命令执行	`NONE`	`NONE`	—	No subprocess or shell execution

1 高危 4 项发现

🔑

高危 API 密钥疑似硬编码凭证

API_KEY="your_appkey_here"

SKILL.md:23

🔗

中危外部 URL 外部 URL

https://www.jisuapi.com/

SKILL.md:9

🔗

中危外部 URL 外部 URL

https://www.jisuapi.com/api/mobileempty/

SKILL.md:16

🔗

中危外部 URL 外部 URL

https://api.jisuapi.com/mobileempty/query

mobileempty.py:14

2 文件 · 7.2 KB · 210 行

Markdown 1f · 121L Python 1f · 89L

├─ 🐍 mobileempty.py Python 89L · 2.1 KB

└─ 📝 SKILL.md Markdown 121L · 5.1 KB

包名	版本	来源	已知漏洞	备注
`requests`	`*`	pip	否	No version pinning - consider pinning for reproducibility

✓ No shell or subprocess execution

✓ No credential harvesting or exfiltration

✓ No sensitive path access (~/.ssh, ~/.aws, .env)

✓ No base64, eval, or obfuscated code

✓ No hidden functionality beyond declared API wrapper

✓ Environment variable read is declared and necessary

✓ Network requests are declared in SKILL.md and essential to service