中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:21 hr ago Rescan
15 /100
post-content-moderation
Review, rewrite, and moderate user-generated posts across title, body text, images, and videos to block ads and contact information
This is a legitimate content moderation skill with declared network access. The skill transparently documents that user content (posts, images, videos) may be sent to external APIs for moderation. No executable code exists, only markdown documentation. Minor documentation artifacts reference non-existent PHP scripts.
Skill Namepost-content-moderation
Duration48.3s
Enginepi
✓
Safe to install
This skill is safe to use. When deploying, ensure external API endpoints are properly allowlisted and environment variables are used for secrets. Be aware that user-generated content will leave the local environment for moderation.

Findings 2 items

Severity Finding Location
Low
Referenced PHP scripts not present in package Doc Mismatch
Documentation references bundled PHP scripts (config.php, moderation_support.php, php_xai_client_example.php, etc.) but no script files exist in the package. Only markdown documentation is present.
scripts/config.php, scripts/moderation_support.php, scripts/php_xai_client_example.php
→ This appears to be documentation-only intent. Remove script references or provide the actual scripts if executable functionality is intended.
 references/php-example-notes.md:4
Low
User content explicitly declared for external transmission Sensitive Access
SKILL.md clearly states that post text, images, videos, and URLs may leave the local environment. This is expected behavior for a moderation skill but should be acknowledged by operators.
any post text, comment text, whitelist, custom rules, image URLs, or video URLs included in the payload may leave the local environment
→ Ensure users/operators are informed that content submitted for moderation will be sent to external AI APIs for analysis.
 SKILL.md:18
ResourceDeclaredInferredStatusEvidence
Network READ READ ✓ Aligned SKILL.md: 'bundled PHP scripts can send moderation payloads to external APIs'
Filesystem NONE NONE — No file operations in this skill
Shell NONE NONE — No shell execution referenced
5 findings
🔗
Medium External URL 外部 URL
https://cdn.example.com/a.jpg
references/api-integration.md:30
🔗
Medium External URL 外部 URL
https://cdn.example.com/a.mp4
references/api-integration.md:33
🔗
Medium External URL 外部 URL
https://api.x.ai/v1/chat/completions
references/api-integration.md:150
🔗
Medium External URL 外部 URL
https://cdn.example.com/post/10001-1.jpg
references/api-spec.md:21
🔗
Medium External URL 外部 URL
https://cdn.example.com/post/10001-1.mp4
references/api-spec.md:24

File Tree

9 files · 43.3 KB · 1510 lines
Markdown 9f · 1510L
├─ ▾ 📁 references
│ ├─ 📝 api-integration.md Markdown 199L · 4.6 KB
│ ├─ 📝 api-spec.md Markdown 288L · 7.1 KB
│ ├─ 📝 install-and-usage.md Markdown 123L · 3.5 KB
│ ├─ 📝 php-demo-suite.md Markdown 100L · 2.8 KB
│ ├─ 📝 php-example-notes.md Markdown 80L · 2.4 KB
│ ├─ 📝 prompt-templates.md Markdown 111L · 2.9 KB
│ ├─ 📝 release-notes.zh-CN.md Markdown 108L · 3.2 KB
│ └─ 📝 rule-template.md Markdown 84L · 1.6 KB
└─ 📝 SKILL.md Markdown 417L · 15.2 KB

Security Positives

✓ SKILL.md explicitly declares network capabilities and data exfiltration scope
✓ Security best practices are documented (environment variables, allowlisting, dry-run testing)
✓ Media inspection limitations are disclosed (placeholder only, no real OCR/QR)
✓ Example URLs use placeholder domains (example.com, api.x.ai in examples)
✓ No hardcoded credentials or API keys in documentation
✓ No obfuscation, reverse shell, or credential harvesting patterns detected
✓ Skill recommends fail-closed policy for ambiguous cases