turkish-locale 安全扫描报告 — 低风险 | ClawSafe

20 /100

turkish-locale

Turkish locale skill pack for Hermes Agent — Turkish news, BIST100 stock tracking, daily brief automation

Legitimate Turkish locale hackathon project with minor documentation discrepancies but no malicious behavior detected.

技能名称turkish-locale

分析耗时58.9s

引擎pi

✓

可以安装

Consider adding explicit network and filesystem declarations in SKILL.md to align with actual usage. Pin dependency versions for reproducibility.

安全发现 3 项

严重性	安全发现	位置
低危	Dependency documentation mismatch 文档欺骗 SKILL.md states 'Dependencies: curl, python3 (stdlib only — no pip packages required)' but actual scripts require 'requests' and 'Pillow' packages. `Dependencies: curl, python3 (stdlib only — no pip packages required)` → Update documentation to list actual pip dependencies: requests, Pillow	`SKILL.md:130`
低危	Undeclared network API usage 文档欺骗 Scripts use network to access CoinGecko API, Telegram Bot API, and Turkish news RSS feeds without explicit network permissions declared. `requests.get(COINGECKO_MARKETS_API, params=params, headers=headers, timeout=15)` → Document network access to api.coingecko.com, api.telegram.org, and RSS feed domains	`scripts/bist100_prices.py:104`
低危	Unpinned package versions 供应链 Dependencies use unpinned versions (requests, Pillow) which could introduce supply chain risk over time. `import requests` → Pin versions in requirements file: requests>=2.28.0, Pillow>=9.0.0	`scripts/bist100_prices.py:24`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`WRITE`	✓ 一致	turkish_brief_card.py writes PNG files to output path
网络访问	`NONE`	`READ`	✓ 一致	bist100_prices.py fetches CoinGecko API; telegram_send.py calls Telegram API
命令执行	`NONE`	`READ`	✓ 一致	SKILL.md references terminal() for curl-based RSS fetching
环境变量	`NONE`	`READ`	✓ 一致	telegram_send.py reads TELEGRAM_BOT_TOKEN and TELEGRAM_HOME_CHANNEL

43 项发现

🔗

中危外部 URL 外部 URL

https://www.bloomberght.com/borsa/endeksler/bist-100

bist100/SKILL.md:100

🔗

中危外部 URL 外部 URL

https://www.bloomberght.com/borsa/hisseler/THYAO

bist100/SKILL.md:104

🔗

中危外部 URL 外部 URL

https://www.bloomberght.com/doviz

bist100/SKILL.md:108

🔗

中危外部 URL 外部 URL

https://www.bloomberght.com/altin

bist100/SKILL.md:112

🔗

中危外部 URL 外部 URL

https://bigpara.hurriyet.com.tr/borsa/canli-borsa/

bist100/SKILL.md:120

🔗

中危外部 URL 外部 URL

https://bigpara.hurriyet.com.tr/doviz/

bist100/SKILL.md:123

🔗

中危外部 URL 外部 URL

https://bigpara.hurriyet.com.tr/altin/

bist100/SKILL.md:126

🔗

中危外部 URL 外部 URL

https://tr.investing.com/indices/ise-100

bist100/SKILL.md:133

🔗

中危外部 URL 外部 URL

https://tr.investing.com/

bist100/SKILL.md:136

🔗

中危外部 URL 外部 URL

https://query1.finance.yahoo.com/v8/finance/chart/XU100.IS?interval=1d&range=1d

bist100/SKILL.md:145

🔗

中危外部 URL 外部 URL

https://query1.finance.yahoo.com/v8/finance/chart/THYAO.IS?interval=1d&range=1d

bist100/SKILL.md:148

🔗

中危外部 URL 外部 URL

https://query1.finance.yahoo.com/v8/finance/chart/USDTRY=X?interval=1d&range=1d

bist100/SKILL.md:151

🔗

中危外部 URL 外部 URL

https://query1.finance.yahoo.com/v8/finance/chart/EURTRY=X?interval=1d&range=1d

bist100/SKILL.md:154

🔗

中危外部 URL 外部 URL

https://query1.finance.yahoo.com/v8/finance/chart/GC=F?interval=1d&range=1d

bist100/SKILL.md:157

🔗

中危外部 URL 外部 URL

https://www.tcmb.gov.tr/kurlar/today.xml

bist100/SKILL.md:379

🔗

中危外部 URL 外部 URL

https://api.coingecko.com/api/v3/coins/markets

scripts/bist100_prices.py:104

🔗

中危外部 URL 外部 URL

https://api.telegram.org/bot

scripts/telegram_send.py:41

🔗

中危外部 URL 外部 URL

https://www.hurriyet.com.tr/rss/anasayfa

turkish-daily-brief/SKILL.md:161

🔗

中危外部 URL 外部 URL

https://www.ntv.com.tr/son-dakika.rss

turkish-daily-brief/SKILL.md:162

🔗

中危外部 URL 外部 URL

https://www.bloomberght.com/rss

turkish-daily-brief/SKILL.md:163

🔗

中危外部 URL 外部 URL

https://www.hurriyet.com.tr/rss/gundem

turkish-news/SKILL.md:38

🔗

中危外部 URL 外部 URL

https://www.hurriyet.com.tr/rss/ekonomi

turkish-news/SKILL.md:39

🔗

中危外部 URL 外部 URL

https://www.hurriyet.com.tr/rss/dunya

turkish-news/SKILL.md:40

🔗

中危外部 URL 外部 URL

https://www.hurriyet.com.tr/rss/teknoloji

turkish-news/SKILL.md:41

🔗

中危外部 URL 外部 URL

https://www.hurriyet.com.tr/rss/spor

turkish-news/SKILL.md:42

🔗

中危外部 URL 外部 URL

https://www.sabah.com.tr/rss/anasayfa.xml

turkish-news/SKILL.md:47

🔗

中危外部 URL 外部 URL

https://www.sabah.com.tr/rss/gundem.xml

turkish-news/SKILL.md:48

🔗

中危外部 URL 外部 URL

https://www.sabah.com.tr/rss/ekonomi.xml

turkish-news/SKILL.md:49

🔗

中危外部 URL 外部 URL

https://www.sabah.com.tr/rss/dunya.xml

turkish-news/SKILL.md:50

🔗

中危外部 URL 外部 URL

https://www.sabah.com.tr/rss/teknoloji.xml

turkish-news/SKILL.md:51

🔗

中危外部 URL 外部 URL

https://www.bloomberght.com/rss/piyasa

turkish-news/SKILL.md:57

🔗

中危外部 URL 外部 URL

https://www.bloomberght.com/rss/haberler

turkish-news/SKILL.md:58

🔗

中危外部 URL 外部 URL

https://tr.cointelegraph.com/rss

turkish-news/SKILL.md:63

🔗

中危外部 URL 外部 URL

https://www.ntv.com.tr/turkiye.rss

turkish-news/SKILL.md:69

🔗

中危外部 URL 外部 URL

https://www.ntv.com.tr/ekonomi.rss

turkish-news/SKILL.md:70

🔗

中危外部 URL 外部 URL

https://www.ntv.com.tr/dunya.rss

turkish-news/SKILL.md:71

🔗

中危外部 URL 外部 URL

https://www.ntv.com.tr/teknoloji.rss

turkish-news/SKILL.md:72

🔗

中危外部 URL 外部 URL

https://www.aa.com.tr/tr/rss/default?cat=guncel

turkish-news/SKILL.md:77

🔗

中危外部 URL 外部 URL

https://www.aa.com.tr/tr/rss/default?cat=ekonomi

turkish-news/SKILL.md:78

🔗

中危外部 URL 外部 URL

https://www.aa.com.tr/tr/rss/default?cat=dunya

turkish-news/SKILL.md:79

🔗

中危外部 URL 外部 URL

https://www.aa.com.tr/tr/rss/default?cat=spor

turkish-news/SKILL.md:80

🔗

中危外部 URL 外部 URL

https://www.trthaber.com/sondakika.rss

turkish-news/SKILL.md:87

🔗

中危外部 URL 外部 URL

https://www.dunya.com/rss

turkish-news/SKILL.md:92

目录结构

7 文件 · 93.6 KB · 2722 行

Python 3f · 1403L Markdown 4f · 1319L

├─ ▾ 📁 bist100

│ └─ 📝 SKILL.md Markdown 392L · 11.8 KB

├─ ▾ 📁 scripts

│ ├─ 🐍 bist100_prices.py Python 516L · 16.8 KB

│ ├─ 🐍 telegram_send.py Python 377L · 13.2 KB

│ └─ 🐍 turkish_brief_card.py Python 510L · 20.6 KB

├─ ▾ 📁 turkish-daily-brief

│ └─ 📝 SKILL.md Markdown 429L · 14.6 KB

├─ ▾ 📁 turkish-news

│ └─ 📝 SKILL.md Markdown 298L · 9.3 KB

└─ 📝 SKILL.md Markdown 200L · 7.2 KB

依赖分析 2 项

包名	版本	来源	已知漏洞	备注
`requests`	`unpinned`	pip	否	Version not pinned; stdlib-only claim in docs is incorrect
`Pillow`	`unpinned`	pip	否	Version not pinned; used for PNG card generation

安全亮点

✓ No credential harvesting or exfiltration observed

✓ No obfuscation techniques (base64, eval, atob) detected

✓ No sensitive file access (~/.ssh, ~/.aws, .env files not accessed)

✓ No reverse shell, C2, or data theft behavior

✓ No hidden functionality beyond documented features

✓ Network requests go to legitimate, publicly known APIs

✓ Environment variables used only for documented Telegram integration

✓ All external URLs are legitimate Turkish news and finance sources