中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：1 天前 重新扫描
15 /100
github-automation
Automate common GitHub tasks — create issues, check PR status, list repos, manage projects.
A straightforward GitHub API CLI with no hidden or malicious behavior; the only concern is disabled SSL verification for GitHub API requests, which has a plausible legitimate use case.
技能名称github-automation
分析耗时29.1s
引擎pi
✓
可以安装
Re-enable SSL certificate verification by removing ctx.check_hostname and ctx.verify_mode overrides, or limit the SSL bypass to internal/CustomHTTPSBackend proxies only.

安全发现 1 项

严重性 安全发现 位置
中危
SSL certificate verification disabled 敏感访问
The SSL context used for GitHub API requests has check_hostname=False and verify_mode=ssl.CERT_NONE, disabling all server certificate validation. This exposes the GitHub token to interception via man-in-the-middle attacks on the network path to api.github.com.
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
→ Remove the two lines setting check_hostname and verify_mode, allowing Python's default certificate verification to run. If TLS inspection is required, validate the proxy certificate separately rather than disabling verification globally.
 scripts/gh_tool.py:30
资源类型声明权限推断权限状态证据
网络访问 READ READ ✓ 一致 urllib.request.urlopen to https://api.github.com, lines 32-63
环境变量 READ READ ✓ 一致 os.environ.get('GITHUB_TOKEN'), lines 14-20 — used for GitHub auth only
命令执行 NONE NONE — No subprocess/os.system/eval calls found
文件系统 NONE NONE — No file read/write operations in gh_tool.py

目录结构

2 文件 · 7.6 KB · 266 行
Python 1f · 181L Markdown 1f · 85L
├─ ▾ 📁 scripts
│ └─ 🐍 gh_tool.py Python 181L · 5.9 KB
└─ 📝 SKILL.md Markdown 85L · 1.7 KB

安全亮点

✓ No shell execution (subprocess, os.system, eval) — code is purely a GitHub API client
✓ No credential exfiltration — GITHUB_TOKEN is read but never transmitted anywhere other than the official GitHub API
✓ No filesystem access declared or implemented
✓ No obfuscation (no base64, no exec/eval chains)
✓ SKILL.md accurately describes all functionality — no doc-to-code mismatch
✓ No supply-chain risk — no external dependencies, only stdlib
✓ Token is scoped to GitHub API only, with no network I/O to third-party hosts