中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:18 hr ago Rescan
5 /100
long-to-short
Sparki AI skill for turning long videos into short-form clips with hooks and cleaner cutdowns
Legitimate Sparki AI video editing CLI tool with no malicious behavior detected; all declared permissions match actual implementation.
Skill Namelong-to-short
Duration37.9s
Enginepi
✓
Safe to install
This skill is safe to use. No security concerns identified.

Findings 1 items

Severity Finding Location
Low
Dependencies use loose version constraints Supply Chain
All dependencies (typer>=0.9.0, httpx>=0.27.0, pydantic>=2.0.0) use >= pins instead of exact versions or ~ constraints. While not inherently malicious, this allows minor/patch updates without review.
typer>=0.9.0
→ Consider pinning to specific versions (e.g., typer==0.12.0) for reproducible builds.
 pyproject.toml:10
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned config.py:18-19 writes to $HOME/.openclaw/config; cli.py:62 writes project histo…
Network READ READ ✓ Aligned client.py:37-39 all API calls to agent-api.sparki.io; download_result follows re…
Shell NONE NONE — No subprocess, os.system, or shell execution found in codebase
Environment NONE READ ✓ Aligned config.py:20 checks SPARKI_API_KEY env var; cli.py has no undeclared environment…
7 findings
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/ClawHub-Skill-blueviolet
README.md:3
🔗
Medium External URL 外部 URL
https://clawhub.io
README.md:3
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/version-1.0.12-blue
README.md:4
🔗
Medium External URL 外部 URL
https://sparki.io
SKILL.md:17
🔗
Medium External URL 外部 URL
https://agent-api.sparki.io
src/sparki_cli/constants.py:61
🔗
Medium External URL 外部 URL
https://t.me/Sparki_AI_bot/upload
src/sparki_cli/constants.py:62
🔗
Medium External URL 外部 URL
https://sparki.io/pricing
src/sparki_cli/constants.py:101

File Tree

11 files · 33.3 KB · 1010 lines
Python 7f · 904L Markdown 2f · 71L TOML 1f · 31L JSON 1f · 4L
├─ ▾ 📁 src
│ └─ ▾ 📁 sparki_cli
│ ├─ 🐍 __init__.py Python 3L · 81 B
│ ├─ 🐍 cli.py Python 507L · 17.1 KB
│ ├─ 🐍 client.py Python 99L · 4.0 KB
│ ├─ 🐍 config.py Python 55L · 1.9 KB
│ ├─ 🐍 constants.py Python 139L · 4.8 KB
│ ├─ 🐍 models.py Python 59L · 1.3 KB
│ └─ 🐍 output.py Python 42L · 1.0 KB
├─ 📋 _meta.json JSON 4L · 53 B
├─ 📄 pyproject.toml TOML 31L · 579 B
├─ 📝 README.md Markdown 28L · 1.0 KB
└─ 📝 SKILL.md Markdown 43L · 1.5 KB

Dependencies 3 items

PackageVersionSourceKnown VulnsNotes
typer >=0.9.0 pip No Major version pinned only
httpx >=0.27.0 pip No Major version pinned only
pydantic >=2.0.0 pip No Major version pinned only

Security Positives

✓ No subprocess, os.system, shell execution, or base64/eval found anywhere in the codebase
✓ All network traffic confined to declared domain agent-api.sparki.io
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env files)
✓ No credential exfiltration or data theft patterns
✓ No obfuscation techniques (base64 encoding, dynamic execution, anti-analysis)
✓ No hidden functionality or doc-to-code mismatch
✓ Configuration writes scoped to declared paths only ($HOME/.openclaw/config, $HOME/.openclaw/workspace/sparki/videos)
✓ No persistence mechanisms (no cron, startup hooks, or backdoor installation)
✓ Uses reputable, well-audited dependencies (httpx, typer, pydantic)
✓ Clean async HTTP implementation using httpx AsyncClient throughout