低风险 — 风险评分 15/100
上次扫描:1 天前 重新扫描
15 /100
news-trust-check
Verify suspicious news, announcements, screenshots, and viral claims using a high-trust source pool
A benign news credibility checker skill that uses keyword-based risk scoring with no network access, credential exposure, or malicious functionality detected.
技能名称news-trust-check
分析耗时26.8s
引擎pi
可以安装
Declare allowed-tools and script execution in SKILL.md to eliminate documentation gaps. Otherwise safe to use.

安全发现 1 项

严重性 安全发现 位置
低危
No allowed-tools declaration 文档欺骗
SKILL.md does not declare any allowed-tools. While assess_claim.py is purely local and benign, the absence of a declaration creates an audit gap.
No allowed-tools section present
→ Add 'allowed-tools: Read' to the frontmatter to document the minimum toolset required.
SKILL.md:1
资源类型声明权限推断权限状态证据
文件系统 NONE READ ✓ 一致 Script reads no files; SKILL.md references sources by name only
网络访问 NONE NONE No HTTP requests, DNS lookups, or external calls in assess_claim.py
命令执行 NONE NONE assess_claim.py is pure Python with no subprocess; no shell commands in SKILL.md…

目录结构

3 文件 · 3.8 KB · 146 行
Markdown 2f · 109L Python 1f · 37L
├─ 📁 references
│ └─ 📝 high-trust-sources.md Markdown 45L · 1.2 KB
├─ 📁 scripts
│ └─ 🐍 assess_claim.py Python 37L · 1.0 KB
└─ 📝 SKILL.md Markdown 64L · 1.6 KB

安全亮点

✓ No network access or data exfiltration — assess_claim.py performs only in-memory string matching
✓ No credential access or harvesting — script contains no os.environ, config files, or key lookups
✓ No obfuscation — code is plain Python with readable logic and no base64, eval, or dynamic exec
✓ No remote code execution — no curl|bash, wget|sh, or subprocess calls
✓ No supply chain risk — assess_claim.py has zero third-party imports (only argparse, json, sys from stdlib)
✓ Risk scoring logic is deterministic, auditable, and clearly documented with Chinese fraud-related keywords
✓ Skill purpose (news trust verification) is clearly stated and matches implementation