中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：2 天前 重新扫描
5 /100
us-market-briefing
Generate production-ready US pre-market outlooks and post-market recaps in a fixed 3-section format
This is a straightforward US market briefing skill with no malicious indicators. All behavior is well-documented in SKILL.md, including web data collection, cron automation, and local file operations for budget tracking.
技能名称us-market-briefing
分析耗时31.1s
引擎pi
✓
可以安装
No action required. The skill is safe to use.

安全发现 2 项

严重性 安全发现 位置
提示
Allowed-tools not formally declared
SKILL.md uses web_search, web_fetch, and cron in documentation but doesn't include a formal allowed-tools section mapping these to resources. This is a minor documentation gap rather than a security concern.
Skills that use external tools should list them in an allowed-tools section
→ Add a formal allowed-tools declaration section for clarity
 SKILL.md:1
提示
No dependencies in Python script
scripts/is-us-market-holiday.py uses only Python standard library (json, sys, datetime, pathlib). No external packages required.
import json, sys, datetime, pathlib
→ No action needed
 scripts/is-us-market-holiday.py:1
资源类型声明权限推断权限状态证据
文件系统 READ WRITE ✓ 一致 SKILL.md line 82-102: memory/market-briefing-usage.json tracking with documented…
网络访问 READ READ ✓ 一致 SKILL.md line 53-65: Source Collection Rules explicitly declares web_search and …
命令执行 NONE NONE — No shell execution found; python3 is called only via subprocess by OpenClab runt…
环境变量 NONE NONE — No environment variable access observed
技能调用 READ READ ✓ 一致 SKILL.md line 25-33: cron automation via OpenClab

目录结构

5 文件 · 9.8 KB · 300 行
Markdown 3f · 255L Python 1f · 40L JSON 1f · 5L
├─ ▾ 📁 references
│ ├─ 📝 templates.md Markdown 87L · 1.7 KB
│ └─ 📝 us-market-holidays-2026.md Markdown 25L · 748 B
├─ ▾ 📁 scripts
│ └─ 🐍 is-us-market-holiday.py Python 40L · 1.4 KB
├─ 📋 _meta.json JSON 5L · 137 B
└─ 📝 SKILL.md Markdown 143L · 5.9 KB

安全亮点

✓ No credential harvesting or sensitive path access (~/.ssh, ~/.aws, .env)
✓ No base64 encoded payloads or obfuscated code
✓ No remote script execution (curl|bash, wget|sh)
✓ No direct IP network requests or C2 indicators
✓ All file operations (memory/market-briefing-usage.json) are explicitly documented
✓ Cron automation explicitly restricts to OpenClab only, prohibits system crontab editing
✓ Source code is simple, readable, and performs stated function only
✓ No hidden functionality in HTML comments or documentation
✓ No exfiltration or data POST to external endpoints