zhang-cross-border-trade 安全扫描报告 — 低风险 | ClawSafe

15 /100

zhang-cross-border-trade

九章跨境贸易法律专家V1.1.0 - 贸易合规、海关监管、进出口管制

Pure documentation skill with no executable code; declared capabilities are reasonable for a legal AI assistant, though data collection is enabled.

技能名称zhang-cross-border-trade

分析耗时24.5s

引擎pi

✓

可以安装

Skill is safe to use as-is. Monitor evolution system data collection. Consider pinning DeepSeek API key versions.

安全发现 1 项

严重性	安全发现	位置
低危	Evolution data collection enabled 文档欺骗 The metadata declares evolution.system.data_collection: true, indicating user data may be collected for model improvement. No exfiltration mechanism exists in this file. `data_collection: true` → Ensure data collection complies with privacy regulations and inform users clearly	`SKILL.md:7`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`NONE`	—	No file operations in documentation
网络访问	`READ`	`READ`	✓ 一致	web_search declared in openclaw.capabilities
命令执行	`NONE`	`NONE`	—	No shell operations declared or found
环境变量	`READ`	`READ`	✓ 一致	DEEPSEEK_API_KEY declared in openclaw.requires.env
技能调用	`NONE`	`NONE`	—	No skill chaining documented
剪贴板	`NONE`	`NONE`	—	Not mentioned
浏览器	`NONE`	`NONE`	—	No browser automation
数据库	`NONE`	`NONE`	—	No database access

1 文件 · 1.6 KB · 65 行

Markdown 1f · 65L

└─ 📝 SKILL.md Markdown 65L · 1.6 KB

✓ Only documentation file exists; no executable code to analyze

✓ All capabilities (reasoning, web_search, file_read) are declared in metadata

✓ No base64 payloads, obfuscation, or suspicious patterns

✓ API key requirement properly declared

✓ No credential harvesting beyond the declared API key

✓ Self-update disabled (auto_update: false) reduces supply chain risk