中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：1 天前 重新扫描
5 /100
space-query-skill
Multi-platform query builder for network asset discovery (FOFA, Quake, ZoomEye, Shodan)
Pure documentation skill for building network asset discovery queries; no executable code, no malicious functionality, and flagged IPs are standard example/demonstration addresses.
技能名称space-query-skill
分析耗时37.8s
引擎pi
✓
可以安装
No action required. The skill is safe to use as designed.

安全发现 1 项

严重性 安全发现 位置
提示
Hardcoded IP addresses in documentation 文档欺骗
resources/fields.md contains example IP addresses (1.1.1.1, 220.181.111.1, 1.2.3.4) used as demonstration data for query syntax examples. These are standard example IPs, not indicators of malicious targeting.
ip | IPv4 address | `ip="1.1.1.1"`
→ This is benign - 1.1.1.1 is Cloudflare DNS, 220.181.111.1 is demonstration data, 1.2.3.4 is IANA reserved example IP.
 resources/fields.md:10
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 SKILL.md uses Read operations to access resources/fields.md
网络访问 READ READ ✓ 一致 SKILL.md instructs to use WebSearch for official CVE queries only
命令执行 NONE NONE — No shell commands found in skill
环境变量 NONE NONE — No environment variable access
技能调用 NONE NONE — No skill invocation capability declared
剪贴板 NONE NONE — No clipboard access
浏览器 NONE NONE — No browser automation
数据库 NONE NONE — No database access
3 高危 9 项发现
📡
高危 IP 地址 硬编码 IP 地址
1.1.1.1
resources/fields.md:10
📡
高危 IP 地址 硬编码 IP 地址
220.181.111.1
resources/fields.md:11
📡
高危 IP 地址 硬编码 IP 地址
1.2.3.4
resources/fields.md:76
🔗
中危 外部 URL 外部 URL
https://fofa.info
README.md:9
🔗
中危 外部 URL 外部 URL
https://quake.360.net
README.md:10
🔗
中危 外部 URL 外部 URL
https://zoomeye.org
README.md:11
🔗
中危 外部 URL 外部 URL
https://shodan.io
README.md:12
🔗
中危 外部 URL 外部 URL
https://en.fofa.info/blog
metadata.json:11
🔗
中危 外部 URL 外部 URL
https://quake.360.net/blog
metadata.json:12

目录结构

7 文件 · 21.9 KB · 683 行
Markdown 5f · 634L JSON 2f · 49L
├─ ▾ 📁 evals
│ └─ 📋 evals.json JSON 35L · 1.3 KB
├─ ▾ 📁 resources
│ └─ 📝 fields.md Markdown 233L · 7.2 KB
├─ 📝 AGENTS.md Markdown 69L · 2.2 KB
├─ 📝 CLAUDE.md Markdown 46L · 1.4 KB
├─ 📋 metadata.json JSON 14L · 560 B
├─ 📝 README.md Markdown 80L · 1.9 KB
└─ 📝 SKILL.md Markdown 206L · 7.4 KB

安全亮点

✓ Pure documentation skill with no executable code
✓ No shell commands, scripts, or binary files present
✓ All functionality clearly declared in SKILL.md
✓ No credential harvesting, data exfiltration, or persistence mechanisms
✓ External URLs are legitimate platform references (fofa.info, quake.360.net, etc.)
✓ CVE query methodology is well-documented and follows responsible disclosure practices