中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 20/100
上次扫描：1 天前 重新扫描
20 /100
taobao-shangou
查询淘宝闪购每日福利优惠券和红包
A legitimate Taobao coupon query tool with no malicious behavior detected; minor documentation gaps regarding declared permissions.
技能名称taobao-shangou
分析耗时32.7s
引擎pi
✓
可以安装
Add explicit permission declarations in SKILL.md (filesystem:WRITE for caching, network:READ for API calls) to align with the capability model.

安全发现 2 项

严重性 安全发现 位置
低危
Missing permission declarations in SKILL.md 文档欺骗
SKILL.md does not declare the actual permissions used by the script: filesystem:WRITE (for caching) and network:READ (for API calls). While this is common practice for simple tools, it violates the capability model documentation requirement.
# 淘宝闪购每日福利查询
→ Add a '## Permissions' or '## Required Capabilities' section declaring filesystem:WRITE and network:READ permissions.
 SKILL.md:1
低危
Undeclared cache file write operation 文档欺骗
The script writes coupon data to data/latest.json for caching purposes. This filesystem write is not mentioned in SKILL.md usage instructions.
DATA_DIR / "latest.json"
→ Document the caching behavior in SKILL.md or make cache writes optional/configurable.
 scripts/fetch_shangou.py:44
资源类型声明权限推断权限状态证据
文件系统 NONE WRITE ✓ 一致 scripts/fetch_shangou.py:44-47 (save_cache writes to data/latest.json)
网络访问 NONE READ ✓ 一致 scripts/fetch_shangou.py:28-39 (urllib.request fetches from external API)
命令执行 NONE NONE — N/A
环境变量 NONE NONE — N/A
技能调用 NONE NONE — N/A
剪贴板 NONE NONE — N/A
浏览器 NONE NONE — N/A
数据库 NONE NONE — N/A
1 项发现
🔗
中危 外部 URL 外部 URL
https://v.jumanjian.com/api/
scripts/fetch_shangou.py:6

目录结构

2 文件 · 5.8 KB · 211 行
Python 1f · 148L Markdown 1f · 63L
├─ ▾ 📁 scripts
│ └─ 🐍 fetch_shangou.py Python 148L · 4.2 KB
└─ 📝 SKILL.md Markdown 63L · 1.6 KB

安全亮点

✓ Uses only Python standard library (urllib, json, pathlib, re) - no third-party dependencies
✓ No credential harvesting or sensitive data access patterns
✓ No subprocess execution or shell command injection vectors
✓ No base64 encoded or obfuscated code
✓ No hidden HTML comments or prompt injection attempts
✓ API call is necessary for tool functionality (legitimate coupon data source)
✓ Proper error handling with try-except blocks
✓ No persistence mechanisms (cron, startup scripts, backdoors)
✓ No exfiltration or C2 communication patterns