中文 EN

Scan Report

Scan New Files

⚠ Suspicious — Risk Score 45/100
Last scan:20 hr ago Rescan
45 /100
remnawave-robot
Remnawave 账号全生命周期自动化管理 - VPN account lifecycle automation
Skill manages VPN account lifecycle with legitimate functionality but exhibits concerning patterns: hardcoded IP endpoint, SSL verification disabled, and suspicious external subscription URLs embedded in documentation.
Skill Nameremnawave-robot
Duration39.7s
Enginepi
⚠
Use with caution
Review hardcoded IP 8.212.8.43 and verify legitimacy of datat.cc subscription URLs. Consider using domain names instead of raw IPs and enabling SSL verification.

Findings 4 items

Severity Finding Location
Medium
Hardcoded IP address as default API endpoint Sensitive Access
The Remnawave API address defaults to raw IP 8.212.8.43 instead of a domain name. This is suspicious for a production service.
const apiBaseUrl = await askQuestion('Remnawave API 地址', 'https://8.212.8.43');
→ Use a proper domain name. If this is a self-hosted instance, document why IP is used instead of hostname.
 setup.js:148
Medium
SSL certificate verification disabled by default Sensitive Access
Configuration sets sslRejectUnauthorized to true (ignoring SSL errors) which allows MITM attacks against the API connection.
sslRejectUnauthorized: sslReject.toLowerCase() === 'true'
→ Enable SSL verification unless self-signed certs are genuinely required. Document the security implication.
 setup.js:158
Medium
Suspicious subscription URLs in documentation Doc Mismatch
SMTP-FIX.md contains URLs to datat.cc domain with 'crypto-link' path - these are the actual subscription URLs being distributed to users. The domain naming is suspicious.
https://46force235a-6cb1-crypto-link.datat.cc/api/sub/wBMXavTEzFbxxY57
→ Verify these are legitimate VPN subscription endpoints. Document the subscription service being used.
 SMTP-FIX.md:176
Low
Configuration stored in parent directory .env Priv Escalation
The API token is stored in ../../.env rather than within the skill directory, giving broader filesystem access scope.
const ENV_FILE = path.join(__dirname, '../../.env');
→ Document why parent directory access is needed and ensure .env is not committed to version control.
 create-account.js:39
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned Reads .env and config JSON files for credential access
Network READ READ ✓ Aligned HTTPS requests to Remnawave API and SMTP servers
Shell NONE NONE — No shell execution in main JS scripts
1 High 20 findings
📡
High IP Address 硬编码 IP 地址
8.212.8.43
PUBLISH-SUMMARY.md:138
🔗
Medium External URL 外部 URL
https://8.212.8.43
PUBLISH-SUMMARY.md:138
🔗
Medium External URL 外部 URL
https://mail.zoho.com
SMTP-FIX.md:50
🔗
Medium External URL 外部 URL
https://46force235a-6cb1-crypto-link.datat.cc/api/sub/wBMXavTEzFbxxY57
SMTP-FIX.md:176
🔗
Medium External URL 外部 URL
https://46force235a-6cb1-crypto-link.datat.cc/api/sub/_6z3BUw1Ca5dqH0d
SMTP-FIX.md:184
🔗
Medium External URL 外部 URL
https://rjdx19yd9zo.sg.larksuite.com/docx/EwMLdN3asoQ44FxOlN6lQ6frgdh?from=from_copylink
create-account.js:186
🔗
Medium External URL 外部 URL
https://v2raytun.com/
create-account.js:187
🔗
Medium External URL 外部 URL
https://testappdownload-bydtmscom.oss-cn-hongkong.aliyuncs.com/OPSFILE/v2RayTun_Setup.zip
create-account.js:188
🔗
Medium External URL 外部 URL
https://apps.apple.com/us/app/v2raytun/id6476628951
create-account.js:189
🔗
Medium External URL 外部 URL
https://sub.example.com/xxx
templates/account-created.md:15
🔗
Medium External URL 外部 URL
https://apps.apple.com/...
templates/account-created.md:19
📧
Info Email 邮箱地址
[email protected]
PUBLISH-SUMMARY.md:106
📧
Info Email 邮箱地址
[email protected]
PUBLISH-SUMMARY.md:108
📧
Info Email 邮箱地址
[email protected]
README.md:71
📧
Info Email 邮箱地址
[email protected]
SMTP-FIX.md:87
📧
Info Email 邮箱地址
[email protected]
SMTP-FIX.md:175
📧
Info Email 邮箱地址
[email protected]
SMTP-FIX.md:205
📧
Info Email 邮箱地址
[email protected]
SMTP-FIX.md:215
📧
Info Email 邮箱地址
[email protected]
SMTP-FIX.md:234
📧
Info Email 邮箱地址
[email protected]
templates/account-created.md:13

File Tree

23 files · 86.4 KB · 3279 lines
JavaScript 12f · 1688L Markdown 8f · 1439L Shell 1f · 97L JSON 2f · 55L
├─ ▾ 📁 templates
│ └─ 📝 account-created.md Markdown 139L · 4.8 KB
├─ 📜 add-to-squad.js JavaScript 140L · 4.2 KB
├─ 📜 create-account.js JavaScript 354L · 11.4 KB
├─ 📜 delete-account.js JavaScript 108L · 3.0 KB
├─ 🔧 fix-zoho-smtp.sh Shell 97L · 3.0 KB
├─ 📜 get-squads.js JavaScript 97L · 2.7 KB
├─ 📝 manual-email-west-pc.md Markdown 68L · 1.6 KB
├─ 📋 package-lock.json JSON 25L · 626 B
├─ 📋 package.json JSON 30L · 793 B
├─ 📝 PUBLISH-SUMMARY.md Markdown 346L · 7.8 KB
├─ 📝 README.md Markdown 116L · 2.3 KB
├─ 📜 resend-email.js JavaScript 97L · 3.3 KB
├─ 📜 search-account.js JavaScript 99L · 2.9 KB
├─ 📜 send-account-email.js JavaScript 122L · 3.7 KB
├─ 📜 setup.js JavaScript 315L · 7.8 KB
├─ 📝 SKILL.md Markdown 289L · 5.9 KB
├─ 📝 SMTP-FIX.md Markdown 240L · 4.6 KB
├─ 📜 sync-squads.js JavaScript 98L · 2.7 KB
├─ 📜 test-config.js JavaScript 166L · 4.8 KB
├─ 📜 test-email.js JavaScript 48L · 1.5 KB
├─ 📜 test-smtp-direct.js JavaScript 44L · 1.3 KB
├─ 📝 技能检查报告 -2026-03-18.md Markdown 8L · 290 B
└─ 📝 技能检查报告-2026-03-18.md Markdown 233L · 5.7 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
nodemailer ^8.0.2 npm No Version not pinned (caret range)

Security Positives

✓ Credentials stored with 0600 permissions (chmod 0o600)
✓ No base64-encoded payloads or obfuscated code
✓ No reverse shell or C2 infrastructure detected
✓ Uses standard HTTPS for API and SMTP connections
✓ No credential exfiltration attempts detected
✓ No unauthorized SSH/AWS credential access
✓ Shell script (fix-zoho-smtp.sh) is a diagnostic tool, not a persistence mechanism