中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 12/100
Last scan:1 day ago Rescan
12 /100
free-scaling
$0 test-time scaling with online learning. Classify, generate, and verify using free model ensembles via NVIDIA NIM
Legitimate AI ensemble classification/generation tool using NVIDIA NIM APIs with optional Copilot integration. All functionality is properly documented; credential access is limited to necessary GitHub token refresh for Copilot features.
Skill Namefree-scaling
Duration47.7s
Enginepi
✓
Safe to install
This skill is safe to use. Ensure GitHub OAuth tokens are protected at rest and audit ~/.openclaw credential files for proper permissions.

Findings 2 items

Severity Finding Location
Low
GitHub OAuth token access for Copilot integration Sensitive Access
Code reads ghu_* tokens from ~/.openclaw/agents/*/agent/auth-profiles.json to refresh Copilot session tokens. This is necessary for the documented cp-* model aliases feature.
if tok.startswith("ghu_"): oauth_token = tok
→ Ensure credential files have restricted permissions (600) and are not world-readable
 nim_ensemble/voter.py:79
Info
Optional Copilot feature properly documented Doc Mismatch
SKILL.md mentions 'Optional: GitHub Copilot token for cp-* model aliases' which aligns with the code's Copilot refresh functionality.
Optional: GitHub Copilot token for `cp-*` model aliases
→ No action needed - documentation is accurate
 SKILL.md:28
ResourceDeclaredInferredStatusEvidence
Network READ READ ✓ Aligned SKILL.md:line1 - Uses NIM/Copilot APIs
Filesystem NONE READ ✓ Aligned nim_ensemble/voter.py:79-108 - Reads GitHub auth-profiles.json and token cache
Environment READ READ ✓ Aligned voter.py:60 - Reads NVIDIA_API_KEY only
Shell NONE NONE — No subprocess/eval/exec found
3 findings
🔗
Medium External URL 外部 URL
https://build.nvidia.com
README.md:3
🔗
Medium External URL 外部 URL
https://integrate.api.nvidia.com/v1/chat/completions
nim_ensemble/models.py:3
🔗
Medium External URL 外部 URL
https://api.individual.githubcopilot.com/chat/completions
nim_ensemble/voter.py:39

File Tree

18 files · 171.9 KB · 4916 lines
Python 16f · 4526L Markdown 2f · 390L
├─ ▾ 📁 nim_ensemble
│ ├─ 🐍 __init__.py Python 57L · 1.9 KB
│ ├─ 🐍 benchmark.py Python 385L · 13.3 KB
│ ├─ 🐍 capability_map.py Python 401L · 15.1 KB
│ ├─ 🐍 cascade.py Python 702L · 26.0 KB
│ ├─ 🐍 cli.py Python 227L · 8.1 KB
│ ├─ 🐍 elo.py Python 247L · 7.9 KB
│ ├─ 🐍 evolve.py Python 103L · 3.4 KB
│ ├─ 🐍 feedback.py Python 294L · 9.7 KB
│ ├─ 🐍 generate.py Python 338L · 11.7 KB
│ ├─ 🐍 health.py Python 124L · 3.9 KB
│ ├─ 🐍 models.py Python 206L · 5.9 KB
│ ├─ 🐍 parser.py Python 111L · 4.0 KB
│ └─ 🐍 voter.py Python 453L · 15.2 KB
├─ ▾ 📁 presets
│ ├─ 🐍 __init__.py Python 1L · 59 B
│ └─ 🐍 audit.py Python 391L · 14.1 KB
├─ ▾ 📁 tests
│ └─ 🐍 test_core.py Python 486L · 18.2 KB
├─ 📝 README.md Markdown 194L · 6.7 KB
└─ 📝 SKILL.md Markdown 196L · 6.8 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
stdlib-only N/A Python 3.10+ stdlib No No external pip dependencies - uses urllib.request for HTTP

Security Positives

✓ No shell execution, subprocess, eval, or exec patterns found
✓ Uses stdlib only (no pip dependencies) - minimal supply chain risk
✓ All external API calls go to legitimate NVIDIA NIM and GitHub Copilot endpoints
✓ No base64-encoded payloads or obfuscated code
✓ No data exfiltration to unknown infrastructure
✓ No credential theft beyond what's necessary for documented features
✓ No persistence mechanisms (no cron, startup hooks, or backdoors)
✓ ThreadPoolExecutor used correctly for parallel API calls with proper error handling