中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：1 天前 重新扫描
5 /100
plan
Think-first execution with approval gating. Use when work is complex, ambiguous, irreversible, multi-step, worth comparing before choosing, interrupted and needs recovery, or long-running enough to need a living plan.
Pure documentation skill providing a read-only approval-gated planning framework with no executable code or sensitive operations.
技能名称plan
分析耗时29.9s
引擎pi
✓
可以安装
This skill is safe to use. It contains only documentation describing a planning methodology with no implementation code.

安全发现 1 项

严重性 安全发现 位置
提示
Toolbox audit concept implies capability not present 文档欺骗
The SKILL.md mentions 'Check relevant installed skills' and 'Search skill registries (ClawHub, GitHub)' which implies potential network access for registry searching. However, no implementation code exists in the package.
Before presenting an execute-oriented plan:
- Check relevant installed skills first
- Check whether a ClawHub skill obviously fits
→ If registry searching is not implemented, remove references to ClawHub/GitHub to avoid confusion about actual capabilities.
 SKILL.md:241
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 Documentation describes read-only exploration before approval
网络访问 NONE NONE — No network operations in code (no code exists)
命令执行 NONE NONE — No shell execution described or implemented
环境变量 NONE NONE — No environment variable access described
技能调用 NONE NONE — Toolbox audit mentions checking skills but no invocation code exists
剪贴板 NONE NONE — No clipboard access described
浏览器 NONE NONE — No browser access described
数据库 NONE NONE — No database access described

目录结构

2 文件 · 12.7 KB · 372 行
Markdown 2f · 372L
├─ ▾ 📁 references
│ └─ 📝 patterns.md Markdown 84L · 4.6 KB
└─ 📝 SKILL.md Markdown 288L · 8.1 KB

安全亮点

✓ No executable code - pure documentation/methodology
✓ Explicit read-only stance until user approval
✓ Approval contract clearly defines when actions are permitted
✓ Surprise policy requires stopping and reporting unexpected changes
✓ No credential, file write, or network access operations
✓ No dependencies to audit for vulnerabilities
✓ Documentation is clear and matches the stated purpose