中文 EN

扫描报告

扫描新文件

✓ 低风险 — 风险评分 5/100
上次扫描：22 小时前 重新扫描
5 /100
Tax Package Preparation
Year-end tax package preparation pipeline for QBO-connected clients. Generates a 9-tab Excel workbook with tax schedules and IRS form mapping.
Documentation-only skill describing a legitimate tax preparation workflow. SKILL.md references non-existent scripts but contains no malicious code or suspicious behavior.
技能名称Tax Package Preparation
分析耗时30.4s
引擎pi
✓
可以安装
No immediate action needed. If implementing this skill, ensure scripts are added and validated for any future security review.

安全发现 1 项

严重性 安全发现 位置
低危
Referenced scripts not present in skill 文档欺骗
SKILL.md documents scripts/pipelines/tax-package-prep.py and pip install commands, but no implementation files exist. This is a doc-to-code mismatch indicating incomplete implementation.
python3 scripts/pipelines/tax-package-prep.py --slug my-client --year 2025
→ If this is a stub skill, document it as such. If implementation exists elsewhere, verify and include it in the skill package.
 SKILL.md:59
资源类型声明权限推断权限状态证据
文件系统 READ NONE ✓ 一致 SKILL.md mentions reading client SOPs but no scripts exist to execute this
网络访问 READ NONE ✓ 一致 SKILL.md mentions QBO API access but no implementation code exists
命令执行 NONE NONE — No shell commands referenced in documentation
环境变量 NONE NONE — No environment variable access described
技能调用 NONE NONE — No skill chaining described
剪贴板 NONE NONE — No clipboard access described
浏览器 NONE NONE — No browser access described
数据库 NONE NONE — No database access described

目录结构

1 文件 · 8.0 KB · 197 行
Markdown 1f · 197L
└─ 📝 SKILL.md Markdown 197L · 8.0 KB

安全亮点

✓ No malicious code patterns detected (no base64, eval, obfuscation)
✓ No credential harvesting or exfiltration mechanisms described
✓ No suspicious network patterns (no direct IP addresses, no C2 indicators)
✓ No hidden functionality or shadow features in documentation
✓ No sensitive path access patterns (no ~/.ssh, ~/.aws, .env references in implementation)
✓ No supply chain risks (no dependencies declared with vulnerable versions)
✓ Legitimate business use case: tax preparation for QBO-connected clients