扫描报告
5 /100
cnpc
Information assistant for 中国石油 CNPC/PetroChina. Search products, news, financials, and official resources.
This is a simple information assistant skill with only documentation (SKILL.md) - no executable code, scripts, or dependencies. The described behavior is benign: web-based information retrieval about CNPC/PetroChina from official sources.
可以安装
No action required. This skill contains only documentation with no executable code or suspicious behavior.
安全发现 1 项
| 严重性 | 安全发现 | 位置 |
|---|---|---|
| 低危 | Web search capability not formally declared 文档欺骗 | SKILL.md:28 |
| 资源类型 | 声明权限 | 推断权限 | 状态 | 证据 |
|---|---|---|---|---|
| 文件系统 | NONE | NONE | — | No file access operations in documentation |
| 网络访问 | READ | READ | ✓ 一致 | SKILL.md line 28-31: describes web search to fetch info from cnpc.com.cn |
| 命令执行 | NONE | NONE | — | No shell command references in documentation |
| 环境变量 | NONE | NONE | — | No environment access mentioned |
| 技能调用 | NONE | NONE | — | No inter-skill invocation described |
| 剪贴板 | NONE | NONE | — | No clipboard access mentioned |
| 浏览器 | NONE | NONE | — | SKILL.md mentions 'web search' but no explicit browser tool declared |
| 数据库 | NONE | NONE | — | No database access mentioned |
1 项发现
中危 外部 URL 外部 URL
https://www.cnpc.com.cn SKILL.md:16 目录结构
1 文件 · 2.0 KB · 56 行 Markdown 1f · 56L
└─
SKILL.md
Markdown
安全亮点
✓ No executable code or scripts present - purely documentation
✓ No credential harvesting or environment variable access
✓ No obfuscated code, base64, or suspicious patterns
✓ References only official legitimate sources (cnpc.com.cn)
✓ No supply chain risks (no dependencies)
✓ No persistence mechanisms or backdoors
✓ No prompt injection or jailbreak attempts
✓ No sensitive file path access (~/.ssh, ~/.aws, .env)
✓ Behavior is fully documented in SKILL.md