budget-builder 安全扫描报告 — 低风险 | ClawSafe

15 /100

budget-builder

Dual-mode budget pipeline for FP&A-quality budget management with QBO integration

Finance-focused budget builder skill with only documentation; no executable code present to analyze for security issues.

技能名称budget-builder

分析耗时27.8s

引擎pi

✓

可以安装

Request actual implementation code (budget-builder.py) before deployment. The SKILL.md references scripts/pipelines/budget-builder.py which does not exist in the package.

安全发现 2 项

严重性	安全发现	位置
低危	Missing implementation reference 文档欺骗 SKILL.md references scripts/pipelines/budget-builder.py but no such file exists in the package. This is a documentation-only stub without actual executable code. `scripts/pipelines/budget-builder.py` → Request the actual Python implementation before security assessment can be completed.	`SKILL.md:31`
低危	Undeclared resource capabilities 文档欺骗 SKILL.md implies filesystem (cache/Excel output) and network (QBO API) access but does not explicitly declare these as capabilities in the frontmatter. `No declared allowed-tools or resource permissions` → Add explicit resource declarations (network:READ, filesystem:WRITE) to the SKILL.md frontmatter.	`SKILL.md:1`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`READ/WRITE`	✓ 一致	SKILL.md:Cache locations and Excel outputs imply file operations but not explici…
网络访问	`NONE`	`READ`	✓ 一致	SKILL.md:QBO API calls implied but not declared as network:READ
命令执行	`NONE`	`NONE`	—	No shell commands in documentation
环境变量	`NONE`	`NONE`	—	No environment variable access documented
技能调用	`NONE`	`NONE`	—	N/A
剪贴板	`NONE`	`NONE`	—	N/A
浏览器	`NONE`	`NONE`	—	N/A
数据库	`NONE`	`NONE`	—	N/A

目录结构

1 文件 · 9.9 KB · 301 行

Markdown 1f · 301L

└─ 📝 SKILL.md Markdown 301L · 9.9 KB

依赖分析 2 项

包名	版本	来源	已知漏洞	备注
`openpyxl`	`*`	pip	否	Version not pinned but library is standard and well-maintained
`Node.js QBO client`	`N/A`	external	否	Referenced but not included; actual client library unknown

安全亮点

✓ Documentation describes standard FP&A workflows with no suspicious command patterns

✓ No references to credential harvesting, base64 encoding, or obfuscation

✓ No mention of remote script execution (curl|bash, wget|sh)

✓ Dependencies are reasonable for a finance tool (openpyxl for Excel)

✓ Error handling appears legitimate (FileNotFoundError, RuntimeError for connection issues)