中文 EN

Scan Report

Scan New Files

⚠ Suspicious — Risk Score 45/100
Last scan:20 hr ago Rescan
45 /100
gougoubi-claim-all-rewards
One-click claim Gougoubi winner, governance, and LP rewards for cryptocurrency addresses
SKILL.md declares script entry points that do not exist in the package, creating a critical doc-to-code mismatch where the skill advertises functionality but has no actual implementation code.
Skill Namegougoubi-claim-all-rewards
Duration32.9s
Enginepi
⚠
Use with caution
Do not use this skill. The referenced scripts (pbft-claim-rewards-*.mjs) are not present in the package. Request the developer to provide the actual implementation scripts or remove the misleading documentation.

Findings 2 items

Severity Finding Location
High
Missing implementation scripts Doc Mismatch
SKILL.md declares three script entry points (scripts/pbft-claim-rewards-profile-method.mjs, scripts/pbft-claim-rewards-quick.mjs, scripts/pbft-claim-three-address-rewards.mjs) but these files do not exist in the package. Pre-scan confirms hasScripts: false.
## Project Scripts
- `scripts/pbft-claim-rewards-profile-method.mjs`
- `scripts/pbft-claim-rewards-quick.mjs`
- `scripts/pbft-claim-three-address-rewards.mjs`
→ Either provide the actual script files or remove the 'Project Scripts' and 'Script Entry Points' sections from SKILL.md. A skill that cannot execute is not useful and may indicate an incomplete or malicious upload.
 SKILL.md:71
Medium
Execution instructions for non-existent files Doc Mismatch
INSTALL.md and README.md provide commands to run the claimed scripts, but these scripts are not included in the package.
node scripts/pbft-claim-rewards-profile-method.mjs --help
→ Remove or update installation verification commands to match actual package contents.
 INSTALL.md:24
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No scripts exist to analyze; declared filesystem access in SKILL.md cannot be ve…
Network NONE NONE — No scripts exist to analyze network behavior
Shell NONE NONE — SKILL.md mentions 'node scripts/...' but scripts absent
Environment NONE NONE — No code to analyze
Skill Invoke NONE NONE — No code to analyze
1 findings
🔗
Medium External URL 外部 URL
https://gougoubi.ai
clawhub.json:22

File Tree

5 files · 5.0 KB · 219 lines
Markdown 4f · 195L JSON 1f · 24L
├─ 📋 clawhub.json JSON 24L · 652 B
├─ 📝 INSTALL.md Markdown 33L · 698 B
├─ 📝 PUBLISH_CLAWHUB.md Markdown 16L · 296 B
├─ 📝 README.md Markdown 32L · 672 B
└─ 📝 SKILL.md Markdown 114L · 2.8 KB

Security Positives

✓ No malicious code detected (no scripts to analyze)
✓ No credential theft attempts observed
✓ No base64 encoded or obfuscated code present
✓ No network exfiltration code found
✓ No sensitive file access patterns detected
✓ No reverse shell or C2 infrastructure references in actual code