中文 EN

扫描报告

扫描新文件

⚠ 可疑 — 风险评分 48/100
上次扫描：1 天前 重新扫描
48 /100
feynman-fsrs-pro
基于 FSRS 算法的费曼学习导师，通过 PostgreSQL 记忆库与 Obsidian 笔记联动
Hardcoded database credentials exposed in SKILL.md and source code create significant credential theft risk; doc-to-code table name mismatch indicates shadow functionality.
技能名称feynman-fsrs-pro
分析耗时54.1s
引擎pi
⚠
谨慎使用
Remove all hardcoded credentials from SKILL.md and source files. Use environment variables for database connection parameters. Correct table name inconsistency between documentation and code.

安全发现 5 项

严重性 安全发现 位置
高危
Database credentials exposed in SKILL.md 凭证窃取
SKILL.md contains plaintext database credentials: username 'openclaw_feiman', password '12345678', host '127.0.0.1'. This is a critical security violation as documentation should never contain sensitive credentials.
用户名：openclaw_feiman
主机：127.0.0.1
密码：12345678
→ Remove all credentials from SKILL.md. Use environment variables or .env file for configuration.
 SKILL.md:17
高危
Hardcoded credentials in feynman_core.js 凭证窃取
feynman_core.js contains hardcoded database connection parameters with weak password '12345678'.
host: '127.0.0.1',
database: 'openclaw_feiman',
password: '12345678'
→ Use environment variables: process.env.DB_PASSWORD, process.env.DB_HOST, etc.
 scripts/feynman_core.js:15
高危
Hardcoded credentials in database.js 凭证窃取
database.js contains identical hardcoded database credentials as feynman_core.js.
user: 'openclaw_feiman',
host: '127.0.0.1',
password: '12345678'
→ Consolidate database config into a single module using environment variables.
 scripts/database.js:7
中危
Table name mismatch between documentation and code 文档欺骗
SKILL.md declares table name as 'feynman_memory', but feynman_core.js queries 'feynman_cards' while database.js queries 'feynman_memory'. schema.sql creates 'feynman_cards'. This inconsistency suggests shadow functionality or copy-paste errors.
SELECT concept_name FROM feynman_cards
→ Standardize table name across all files. Update SKILL.md to reflect actual table name used in code.
 scripts/feynman_core.js:55
低危
Hardcoded Obsidian path references specific user 敏感访问
OBSIDIAN_BASE path points to 'C:\Users\alex\iCloudDrive\iCloud~md~obsidian\new-note', exposing a specific user's directory structure.
C:\\Users\\alex\\iCloudDrive\\iCloud~md~obsidian\\new-note
→ Use environment variable for Obsidian path configuration.
 scripts/database.js:8
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 Reads .md files from Obsidian directory
数据库 WRITE WRITE ✓ 一致 PostgreSQL connection with SELECT/INSERT/UPDATE queries
网络访问 NONE READ ✓ 一致 Connects to local PostgreSQL at 127.0.0.1:5432 (documentation exposes '27.0.0.1'…
命令执行 NONE NONE — No shell execution observed
1 高危 15 项发现
📡
高危 IP 地址 硬编码 IP 地址
27.0.0.1
scripts/feynman_core.js:9
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/pg/-/pg-8.20.0.tgz
scripts/package-lock.json:20
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/pg-cloudflare/-/pg-cloudflare-1.3.0.tgz
scripts/package-lock.json:47
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/pg-connection-string/-/pg-connection-string-2.12.0.tgz
scripts/package-lock.json:54
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/pg-int8/-/pg-int8-1.0.1.tgz
scripts/package-lock.json:60
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/pg-pool/-/pg-pool-3.13.0.tgz
scripts/package-lock.json:69
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/pg-protocol/-/pg-protocol-1.13.0.tgz
scripts/package-lock.json:78
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/pg-types/-/pg-types-2.2.0.tgz
scripts/package-lock.json:84
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/pgpass/-/pgpass-1.0.5.tgz
scripts/package-lock.json:100
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/postgres-array/-/postgres-array-2.0.0.tgz
scripts/package-lock.json:109
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/postgres-bytea/-/postgres-bytea-1.0.1.tgz
scripts/package-lock.json:118
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/postgres-date/-/postgres-date-1.0.7.tgz
scripts/package-lock.json:127
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/postgres-interval/-/postgres-interval-1.2.0.tgz
scripts/package-lock.json:136
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/split2/-/split2-4.2.0.tgz
scripts/package-lock.json:148
🔗
中危 外部 URL 外部 URL
https://registry.npmmirror.com/xtend/-/xtend-4.0.2.tgz
scripts/package-lock.json:157

目录结构

14 文件 · 69.9 KB · 2214 行
JavaScript 9f · 1231L Markdown 2f · 627L JSON 2f · 191L SQL 1f · 165L
├─ ▾ 📁 references
│ └─ 📝 README.md Markdown 312L · 8.1 KB
├─ ▾ 📁 scripts
│ ├─ 📜 check_db.js JavaScript 14L · 366 B
│ ├─ 📜 cli.js JavaScript 70L · 2.4 KB
│ ├─ 📜 database.js JavaScript 351L · 10.2 KB
│ ├─ 📜 feynman_core.js JavaScript 645L · 21.1 KB
│ ├─ 📜 get-note.js JavaScript 5L · 164 B
│ ├─ 📜 index.js JavaScript 28L · 635 B
│ ├─ 📋 package-lock.json JSON 165L · 5.7 KB
│ ├─ 📋 package.json JSON 26L · 487 B
│ ├─ 📜 review-helper.js JavaScript 25L · 795 B
│ ├─ 📜 review-start.js JavaScript 15L · 498 B
│ ├─ 📄 schema.sql SQL 165L · 6.4 KB
│ └─ 📜 update-progress.js JavaScript 78L · 2.9 KB
└─ 📝 SKILL.md Markdown 315L · 10.3 KB

依赖分析 1 项

包名版本来源已知漏洞备注
pg ^8.11.3 npm 否 PostgreSQL client library, version pinned

安全亮点

✓ No shell execution observed - skill uses direct database queries only
✓ No external network requests detected - only local PostgreSQL connection
✓ No obfuscation techniques (base64, eval) found in codebase
✓ No credential exfiltration - hardcoded credentials are only used locally
✓ No reverse shell or C2 infrastructure indicators
✓ No prompt injection payloads detected
✓ Dependencies are minimal (pg library only) with pinned versions