ai-commentary-zh 安全扫描报告 — 可信 | ClawSafe

5 /100

ai-commentary-zh

Sparki AI video editing skill with commentary/narrative focus, Chinese localization

This is a legitimate video editing CLI skill for Sparki AI that strictly adheres to its declared permissions with no malicious behavior.

技能名称ai-commentary-zh

分析耗时32.4s

引擎pi

✓

可以安装

This skill is safe to use. No action required.

资源类型	声明权限	推断权限	状态	证据
文件系统	`READ`	`READ`	✓ 一致	_meta.json: fs.read=[$CWD]; cli.py: Path.exists(), f.stat().st_size
文件系统	`WRITE`	`WRITE`	✓ 一致	_meta.json: fs.write=[$HOME/.openclaw/config, $HOME/.openclaw/workspace/sparki/v…
网络访问	`READ`	`READ`	✓ 一致	_meta.json: network.domains=[agent-api.sparki.io]; client.py: all httpx calls go…
命令执行	`NONE`	`NONE`	—	cli.py: No subprocess, os.system, or shell=True usage
环境变量	`NONE`	`READ`	✓ 一致	config.py: Reads SPARKI_API_KEY env var for legitimate authentication; no enumer…
技能调用	`NONE`	`NONE`	—	No inter-skill invocation observed

7 项发现

🔗

中危外部 URL 外部 URL

https://img.shields.io/badge/ClawHub-Skill-blueviolet

README.md:3

🔗

中危外部 URL 外部 URL

https://clawhub.io

README.md:3

🔗

中危外部 URL 外部 URL

https://img.shields.io/badge/version-1.0.12-blue

README.md:4

🔗

中危外部 URL 外部 URL

https://sparki.io

SKILL.md:17

🔗

中危外部 URL 外部 URL

https://agent-api.sparki.io

src/sparki_cli/constants.py:61

🔗

中危外部 URL 外部 URL

https://t.me/Sparki_AI_bot/upload

src/sparki_cli/constants.py:62

🔗

中危外部 URL 外部 URL

https://sparki.io/pricing

src/sparki_cli/constants.py:101

目录结构

11 文件 · 33.2 KB · 1009 行

Python 7f · 904L Markdown 2f · 70L TOML 1f · 31L JSON 1f · 4L

├─ ▾ 📁 src

│ └─ ▾ 📁 sparki_cli

│ ├─ 🐍 __init__.py Python 3L · 81 B

│ ├─ 🐍 cli.py Python 507L · 17.1 KB

│ ├─ 🐍 client.py Python 99L · 4.0 KB

│ ├─ 🐍 config.py Python 55L · 1.9 KB

│ ├─ 🐍 constants.py Python 139L · 4.8 KB

│ ├─ 🐍 models.py Python 59L · 1.3 KB

│ └─ 🐍 output.py Python 42L · 1.0 KB

├─ 📋 _meta.json JSON 4L · 56 B

├─ 📄 pyproject.toml TOML 31L · 579 B

├─ 📝 README.md Markdown 28L · 941 B

└─ 📝 SKILL.md Markdown 42L · 1.4 KB

依赖分析 3 项

包名	版本	来源	已知漏洞	备注
`typer`	`>=0.9.0`	pip	否	Minimum version pinned
`httpx`	`>=0.27.0`	pip	否	Minimum version pinned
`pydantic`	`>=2.0.0`	pip	否	Minimum version pinned

安全亮点

✓ No shell execution (subprocess, os.system, shell=True) — all operations use Python standard libraries

✓ No obfuscation (base64, atob, eval) — code is human-readable

✓ No credential theft — API key used only for authenticated API calls to sparki.io

✓ No data exfiltration — all network traffic goes to declared domain agent-api.sparki.io

✓ No sensitive path access (~/.ssh, ~/.aws, .env) — only accesses declared config/output directories

✓ No supply chain risk — dependencies are well-known: typer, httpx, pydantic with pinned minimum versions

✓ No hidden functionality — SKILL.md accurately describes behavior; all features traceable to source code

✓ API key check priority: environment variable > config file, a standard secure pattern

✓ Config directory creation uses parents=True, exist_ok=True to avoid race conditions

✓ All HTTP errors caught and surfaced as NETWORK_ERROR, no silent failures