中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 10/100
上次扫描：1 天前 重新扫描
10 /100
studio-agent
ClickZetta Studio integration for task, job, project, and workspace management
The studio-agent skill is a legitimate enterprise data platform integration that handles ClickZetta Studio authentication and workspace management through documented WebSocket and HTTP APIs.
技能名称studio-agent
分析耗时28.8s
引擎pi
✓
可以安装
No action required. The skill operates as documented with appropriate credential handling and no malicious indicators.

安全发现 1 项

严重性 安全发现 位置
低危
Minor documentation gap on cache file writes 文档欺骗
SKILL.md does not explicitly mention that workspace state and discovery data are persisted to ~/.openclaw/cache/, though this behavior is documented in code comments and is essential to the caching mechanism.
// Cache management functions
→ Add a brief note in SKILL.md mentioning local caching behavior for workspace state
 scripts/clickzetta-discovery.mjs:1
资源类型声明权限推断权限状态证据
文件系统 READ WRITE ✓ 一致 Writes to ~/.openclaw/clawdbot.json and ~/.openclaw/cache/ for credential sync a…
网络访问 READ WRITE ✓ 一致 WebSocket connections to CZ_AGENT_WS_URL and HTTP POST to ClickZetta API
命令执行 WRITE WRITE ✓ 一致 Executes node scripts as documented in SKILL.md
2 项发现
🔗
中危 外部 URL 外部 URL
https://dev-api.clickzetta.com
scripts/clickzetta-discovery.mjs:7
🔗
中危 外部 URL 外部 URL
https://api.clickzetta.com
scripts/clickzetta-discovery.mjs:156

目录结构

6 文件 · 101.1 KB · 3620 行
JavaScript 4f · 3472L Markdown 1f · 145L JSON 1f · 3L
├─ ▾ 📁 scripts
│ ├─ 📜 clickzetta-discovery.mjs JavaScript 1209L · 34.0 KB
│ ├─ 📜 cz-agent-oneshot.mjs JavaScript 676L · 19.4 KB
│ ├─ 📜 cz-agent-proxy.mjs JavaScript 1507L · 38.5 KB
│ └─ 📜 utils.mjs JavaScript 80L · 2.0 KB
├─ 📝 SKILL.md Markdown 145L · 7.0 KB
└─ 📋 studio-agent.config.example.json JSON 3L · 111 B

安全亮点

✓ No credential exfiltration or suspicious outbound network requests
✓ No obfuscation techniques (base64, eval, atob) detected
✓ No access to sensitive system paths (~/.ssh, ~/.aws, .env)
✓ No reverse shell, C2, or data theft patterns
✓ All network communication targets legitimate ClickZetta API endpoints
✓ Credentials are handled exclusively through JDBC URL as documented
✓ Cache files are scoped to application-specific directories
✓ JWT token parsing is standard and only used for identity derivation
✓ WebSocket implementation uses native APIs without suspicious behavior