中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：1 天前 重新扫描
5 /100
agent-link
智能体互联技能 - 支持不同电脑上的 OpenClaw 实例和 Agent 通过中转服务器进行安全可靠的通讯
This is a legitimate cross-device agent communication relay skill with no malicious behavior detected. All functionality is properly documented and uses standard WebSocket communication with HMAC-SHA256 message signing.
技能名称agent-link
分析耗时32.1s
引擎pi
✓
可以安装
This skill is safe to use. No security concerns identified.

安全发现 1 项

严重性 安全发现 位置
低危
Plain WebSocket connection default 敏感访问
The skill defaults to ws:// (unencrypted) instead of wss:// (encrypted WebSocket). While WSS is recommended in documentation, the code defaults to non-encrypted connections which could expose message content in transit.
self.websocket = await websockets.connect(self.relay_url)
→ Consider defaulting to wss:// protocol or adding a warning when using unencrypted connections
 scripts/local-agent/agent_link.py:54
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 agent_link.py:188-195 - reads config JSON file via from_config()
网络访问 READ WRITE ✓ 一致 agent_link.py:54-65 - WebSocket connection for sending/receiving messages
命令执行 NONE NONE — No subprocess or shell execution found in codebase
环境变量 NONE NONE — No os.environ access or sensitive variable reading found

目录结构

6 文件 · 25.3 KB · 1019 行
Markdown 3f · 686L Python 1f · 315L JSON 2f · 18L
├─ ▾ 📁 docs
│ └─ 📝 install-agent.md Markdown 237L · 5.0 KB
├─ ▾ 📁 scripts
│ └─ ▾ 📁 local-agent
│ ├─ 🐍 agent_link.py Python 315L · 10.0 KB
│ └─ 📋 agent-link-config.example.json JSON 9L · 235 B
├─ 📋 _meta.json JSON 9L · 348 B
├─ 📝 README.md Markdown 219L · 4.9 KB
└─ 📝 SKILL.md Markdown 230L · 4.8 KB

依赖分析 1 项

包名版本来源已知漏洞备注
websockets * pip 否 No version pinned - consider pinning to specific version for reproducibility

安全亮点

✓ HMAC-SHA256 message signing prevents message forgery
✓ No subprocess or shell execution - pure Python WebSocket client
✓ No credential harvesting or environment variable enumeration
✓ No sensitive file path access (~/.ssh, ~/.aws, .env)
✓ No base64 encoding or obfuscation detected
✓ All functionality is properly documented in SKILL.md
✓ Message relay server does not persist message content
✓ Clean, readable codebase with proper error handling