中文 EN

Scan Report

Scan New Files

✓ Low Risk — Risk Score 10/100
Last scan:20 hr ago Rescan
10 /100
skills-security-scanner
审计和扫描技能的安全性。在启用新技能前使用此工具验证其安全性，确保符合安全策略。
A legitimate security scanning tool that packages and uploads target skills to a Volcengine cloud API for analysis; no malicious behavior, credential theft, or hidden exfiltration found.
Skill Nameskills-security-scanner
Duration25.7s
Enginepi
✓
Safe to install
Skill is safe for use. No action required. Consider pinning the `requests` library version for supply-chain hygiene.

Findings 1 items

Severity Finding Location
Low
Unpinned requests library Supply Chain
The `requests` library has no version pin in the code. While requests is used only for HTTP API calls and has no critical unfixed CVE for this usage, pinning to a specific version is a best practice.
import requests
→ Add a version pin, e.g. `requests>=2.31.0`, to ensure reproducible and auditable dependencies.
 scripts/scan.py:1
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned SKILL.md:12 — targets a directory, reads it into a zip
Network READ READ ✓ Aligned scripts/scan.py:16,19 — POSTs zip to Volcengine API
Shell NONE NONE — No shell execution found
Environment NONE READ ✓ Aligned scripts/scan.py:280-287 — reads AK/SK/env vars to configure API calls; necessary…
Skill Invoke NONE NONE — No skill invocation found
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser usage
Database NONE NONE — No database access
2 findings
🔗
Medium External URL 外部 URL
http://127.0.0.1:8181/api/top/mana-open/cn-north-1/2025-01-01
scripts/scan.py:16
🔗
Medium External URL 外部 URL
https://open.volcengineapi.com
scripts/scan.py:19

File Tree

2 files · 17.2 KB · 425 lines
Python 1f · 367L Markdown 1f · 58L
├─ ▾ 📁 scripts
│ └─ 🐍 scan.py Python 367L · 15.0 KB
└─ 📝 SKILL.md Markdown 58L · 2.2 KB

Dependencies 2 items

PackageVersionSourceKnown VulnsNotes
requests unpinned pip No No version constraint; minor supply-chain concern
volcengine unpinned pip No Volcengine SDK used for API request signing; no version pin

Security Positives

✓ No arbitrary code execution — subprocess/bash not used
✓ No credential theft — AK/SK read from env vars only for signing outbound API calls to Volcengine
✓ No data exfiltration — only uploads the target skill zip (requested by the user) to the scan service
✓ No obfuscation — all code is plain Python, no base64 or eval patterns
✓ No sensitive path access (~/.ssh, ~/.aws, .env of the host) — only zips the user-specified target directory
✓ Network destination is Volcengine public cloud API (open.volcengineapi.com) — legitimate and declared
✓ Full code review shows clean, straightforward logic: zip → sign → upload → poll → return results