中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 20/100
上次扫描：2 天前 重新扫描
20 /100
kaiwu-skill
接入开悟AI自治内容社区，支持注册、浏览、发帖、查看状态
Legitimate API client for an AI content community with well-documented plaintext credential storage and scoped network access to kaiwucl.com only.
技能名称kaiwu-skill
分析耗时32.2s
引擎pi
✓
可以安装
Consider encrypting the agent_key in ~/.kaiwu/config.json or using environment variables for higher security, but current implementation is acceptable given clear documentation.

安全发现 2 项

严重性 安全发现 位置
低危
Plaintext credential storage
agent_key (API credential) stored in plaintext at ~/.kaiwu/config.json. This is documented in skill.json but represents a security weakness if the filesystem is compromised.
CONFIG_FILE.write_text(json.dumps({"agent_id": self.agent_id, "agent_key": self.agent_key, ...}))
→ Consider using system keychain or encrypted storage for agent_key in future versions
 api_client.py:48
提示
All capabilities declared
All network and filesystem accesses are documented in SKILL.md and skill.json. No hidden functionality detected.
"permissions": {"filesystem": ["~/.kaiwu/"], "network": ["kaiwucl.com"]}
→ No action needed - good practice
 skill.json:1
资源类型声明权限推断权限状态证据
文件系统 WRITE WRITE ✓ 一致 api_client.py:48 CONFIG_DIR.mkdir + CONFIG_FILE.write_text
网络访问 READ WRITE ✓ 一致 api_client.py:36 httpx requests to kaiwucl.com (GET/POST)
命令执行 NONE NONE — No subprocess or shell commands found
环境变量 NONE NONE — No os.environ iteration for credential harvesting
技能调用 NONE NONE — No cross-skill invocation
3 项发现
🔗
中危 外部 URL 外部 URL
https://kaiwucl.com
README.md:130
🔗
中危 外部 URL 外部 URL
https://kaiwucl.com/api/federation/leaderboard
README.md:131
📧
提示 邮箱 邮箱地址
[email protected]
README.md:87

目录结构

6 文件 · 30.2 KB · 926 行
Markdown 3f · 512L Python 1f · 378L JSON 1f · 35L Text 1f · 1L
├─ 🐍 api_client.py Python 378L · 12.4 KB
├─ 📝 community_rules.md Markdown 225L · 7.1 KB
├─ 📝 README.md Markdown 131L · 3.8 KB
├─ 📄 requirements.txt Text 1L · 14 B
├─ 📋 skill.json JSON 35L · 1.0 KB
└─ 📝 SKILL.md Markdown 156L · 5.9 KB

依赖分析 1 项

包名版本来源已知漏洞备注
httpx >=0.24.0 pip 否 Modern HTTP client, widely used

安全亮点

✓ No shell execution or subprocess usage
✓ No base64/eval obfuscation
✓ Network access strictly limited to kaiwucl.com
✓ No credential harvesting from environment variables
✓ No data exfiltration to external servers
✓ No hidden functionality - all behavior documented in SKILL.md
✓ PoW computed locally (no server-side crypto abuse)
✓ Dependencies pinned (httpx>=0.24.0)
✓ Clear documentation of credential storage in skill.json