Scan Report
5 /100
video-resizer-zh
面向比例转换和平台适配场景的 Sparki skill 变体，沿用最新版官方 Sparki 安装、API key、上传和命令说明，同时保留 resizer 场景定位
A clean, straightforward video-resizing CLI that strictly adheres to its declared permissions with no hidden functionality, credential harvesting, obfuscation, or network exfiltration.
Safe to install
No action needed. The skill is safe to use.
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Unpinned dependency versions Supply Chain | pyproject.toml:16 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | cli.py:182 — file reads via open() for upload only |
| Filesystem | WRITE | WRITE | ✓ Aligned | config.py:48 — writes to ~/.openclaw/config/sparki.json; cli.py:277 — writes dow… |
| Network | READ | READ | ✓ Aligned | client.py — all HTTP requests go to agent-api.sparki.io only |
| Shell | NONE | NONE | — | No subprocess, os.system, or shell invocation found anywhere in codebase |
| Environment | NONE | READ | ✓ Aligned | config.py:31 — reads SPARKI_API_KEY from os.environ; SKILL.md permissions.env is… |
| Skill Invoke | NONE | NONE | — | No skill invocation or inter-process messaging |
| Clipboard | NONE | NONE | — | No clipboard access |
| Browser | NONE | NONE | — | No browser automation |
| Database | NONE | NONE | — | No database access |
7 findings
Medium External URL 外部 URL
https://img.shields.io/badge/ClawHub-Skill-blueviolet README.md:3 Medium External URL 外部 URL
https://clawhub.io README.md:3 Medium External URL 外部 URL
https://img.shields.io/badge/version-1.0.12-blue README.md:4 Medium External URL 外部 URL
https://sparki.io SKILL.md:17 Medium External URL 外部 URL
https://agent-api.sparki.io src/sparki_cli/constants.py:61 Medium External URL 外部 URL
https://t.me/Sparki_AI_bot/upload src/sparki_cli/constants.py:62 Medium External URL 外部 URL
https://sparki.io/pricing src/sparki_cli/constants.py:101 File Tree
11 files · 33.2 KB · 1009 lines Python 7f · 904L
Markdown 2f · 70L
TOML 1f · 31L
JSON 1f · 4L
├─
▾
src
│ └─
▾
sparki_cli
│ ├─
__init__.py
Python
│ ├─
cli.py
Python
│ ├─
client.py
Python
│ ├─
config.py
Python
│ ├─
constants.py
Python
│ ├─
models.py
Python
│ └─
output.py
Python
├─
_meta.json
JSON
├─
pyproject.toml
TOML
├─
README.md
Markdown
└─
SKILL.md
Markdown
Dependencies 3 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
typer | >=0.9.0 | pyproject.toml | No | Version not pinned — use upper bound |
httpx | >=0.27.0 | pyproject.toml | No | Version not pinned — use upper bound |
pydantic | >=2.0.0 | pyproject.toml | No | Version not pinned — use upper bound |
Security Positives
✓ No shell execution (subprocess, os.system, popen) anywhere in the codebase
✓ No obfuscation: no base64, atob, eval, or encoded payloads
✓ No credential theft: API key is used only for authenticated API calls to declared endpoint
✓ No data exfiltration: all network traffic is limited to agent-api.sparki.io
✓ No hidden functionality: SKILL.md documentation accurately describes the tool's behavior
✓ No sensitive file access: no access to ~/.ssh, ~/.aws, .env, or credential stores
✓ File operations scoped strictly to declared paths (~/.openclaw/config, ~/.openclaw/workspace)
✓ No reverse shell, C2, or persistence mechanisms (no cron, startup hooks, or backdoors)
✓ Clean imports with no suspicious third-party packages