Scan Report
5 /100
design-analysis
自动化设计分析工具，用于分析设计素材并生成结构化的HTML演示文档
Design Analysis skill is a straightforward HTML presentation generator with no malicious behavior detected. It legitimately scans image folders and writes HTML output with no network access, credential harvesting, or hidden functionality.
Safe to install
This skill is safe to use. No security concerns identified. Continue normal usage.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ,WRITE | READ,WRITE | ✓ Aligned | index.js: reads inputFolder, writes outputFile |
| Network | NONE | NONE | — | No network calls found |
| Shell | NONE | NONE | — | execSync only in test.js with hardcoded args |
| Environment | NONE | NONE | — | No env access |
| Clipboard | NONE | NONE | — | Not used |
| Browser | NONE | NONE | — | Not used |
| Database | NONE | NONE | — | Not used |
2 findings
Medium External URL 外部 URL
https://developer.mozilla.org/en-US/docs/Web/Guide/HTML/Using_HTML5 SKILL.md:153 Medium External URL 外部 URL
https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Flexible_Box_Layout SKILL.md:154 File Tree
10 files · 75.8 KB · 2413 lines JavaScript 3f · 918L
HTML 2f · 876L
Markdown 3f · 503L
Shell 1f · 81L
JSON 1f · 35L
├─
index.js
JavaScript
├─
install.sh
Shell
├─
OPENCLAW.md
Markdown
├─
package.json
JSON
├─
README.md
Markdown
├─
run.js
JavaScript
├─
SKILL.md
Markdown
├─
TEST_01_OUTPUT.html
HTML
├─
TEST_02_OUTPUT.html
HTML
└─
test.js
JavaScript
Security Positives
✓ Zero external dependencies - no supply chain attack surface
✓ All capabilities declared and accurate in SKILL.md
✓ No credential access or sensitive file enumeration
✓ No network egress - all operations are local
✓ No obfuscation or base64-encoded execution
✓ Output is deterministic HTML with embedded CSS/JS - auditable
✓ Test.js execSync uses only hardcoded arguments (no user input injection)
✓ No persistence mechanisms (no cron, startup hooks, or backdoors)