中文 EN

Scan Report

Scan New Files

⚠ Suspicious — Risk Score 40/100
Last scan:23 hr ago Rescan
40 /100
likes-training-planner
Complete training plan solution for My Likes platform. Fetches historical data, analyzes training patterns, generates personalized plans, converts to Likes format, and pushes to calendar.
Legitimate training platform skill with documented but dangerous curl|bash installation pattern that creates supply chain risk. Core functionality is benign with no active malicious behavior detected.
Skill Namelikes-training-planner
Duration61.1s
Enginepi
⚠
Use with caution
Replace curl|bash installation with manual download/extract or signed package verification. The current install.sh is benign but the pattern allows remote code injection if repositories are compromised.

Attack Chain 3 steps

⬡
Escalation User executes curl|bash installation from documentation
README.md:37
⬡
Escalation Remote install.sh script executes with user privileges
install.sh:1
⬡
Escalation Malicious install.sh could be served if repository is compromised, executing arbitrary code
install.sh

Findings 2 items

Severity Finding Location
Medium
Dangerous curl|bash installation pattern Supply Chain
SKILL.md and README files recommend 'curl -fsSL <url> | bash' for installation. This pattern allows the remote server to execute arbitrary code on the user's machine. While the current install.sh is benign, the repository could be compromised to serve malicious code.
curl -fsSL https://gitee.com/chenyinshu/likes-training-planner/raw/main/install.sh | bash
→ Replace with manual download instructions or use signed package verification. Consider providing SHA256 checksums for verification.
 README.md:37
Medium
Multiple remote installation sources Supply Chain
Skill provides installation instructions from both Gitee and GitHub. Both sources are third-party and could be independently compromised.
curl -fsSL https://raw.githubusercontent.com/chenwynn/likes-training-planner/main/install.sh | bash
→ Use a single trusted source with integrity verification.
 likes-training-planner/SKILL.md:297
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned SKILL.md declares node scripts that write config/output files to ~/.openclaw/
Network READ READ ✓ Aligned SKILL.md declares LIKES_API_KEY requirement; scripts make HTTPS API calls to my.…
Shell WRITE WRITE ✓ Aligned SKILL.md documents node script execution (node scripts/*.cjs)
Environment READ READ ✓ Aligned Scripts read LIKES_API_KEY from process.env only - legitimate use
2 Critical 9 findings
💀
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://gitee.com/chenyinshu/likes-training-planner/raw/main/install.sh | bash
README.en.md:35
💀
Critical Dangerous Command 危险 Shell 命令
curl -fsSL https://raw.githubusercontent.com/chenwynn/likes-training-planner/main/install.sh | bash
likes-training-planner/SKILL.md:297
🔗
Medium External URL 外部 URL
https://gitee.com/chenyinshu/likes-training-planner/raw/main/install.sh
README.en.md:35
🔗
Medium External URL 外部 URL
https://gitee.com/chenyinshu/likes-training-planner/releases/latest/download/likes-training-planner.skill
README.en.md:43
🔗
Medium External URL 外部 URL
http://127.0.0.1:18789
README.en.md:56
🔗
Medium External URL 外部 URL
https://my.likes.com.cn
README.en.md:63
🔗
Medium External URL 外部 URL
https://gitee.com/chenyinshu/likes-training-planner
README.en.md:276
🔗
Medium External URL 外部 URL
https://gitee.com/chenyinshu/likes-training-planner/releases
README.en.md:277
🔗
Medium External URL 外部 URL
https://my.likes.com.cn/api/open
likes-training-planner/references/api-docs.md:8

File Tree

45 files · 248.8 KB · 9197 lines
JavaScript 31f · 5646L Markdown 11f · 3401L Shell 3f · 150L
├─ ▾ 📁 likes-training-planner
│ ├─ ▾ 📁 references
│ │ ├─ 📝 api-docs.md Markdown 484L · 11.8 KB
│ │ ├─ 📝 code-format.md Markdown 207L · 4.2 KB
│ │ └─ 📝 sport-examples.md Markdown 268L · 6.5 KB
│ ├─ ▾ 📁 scripts
│ │ ├─ 📜 add_feedback_comment.cjs JavaScript 190L · 5.3 KB
│ │ ├─ 📜 analyze_data.cjs JavaScript 162L · 4.5 KB
│ │ ├─ 📜 bot-config.cjs JavaScript 209L · 5.0 KB
│ │ ├─ 📜 bot-router.js JavaScript 52L · 2.0 KB
│ │ ├─ 📜 configure.cjs JavaScript 89L · 2.2 KB
│ │ ├─ 📜 fetch_ability.cjs JavaScript 240L · 8.0 KB
│ │ ├─ 📜 fetch_activities.cjs JavaScript 287L · 8.4 KB
│ │ ├─ 📜 fetch_feedback.cjs JavaScript 247L · 7.1 KB
│ │ ├─ 📜 fetch_game.cjs JavaScript 193L · 5.2 KB
│ │ ├─ 📜 fetch_games.cjs JavaScript 175L · 4.7 KB
│ │ ├─ 📜 fetch_plans.cjs JavaScript 179L · 4.6 KB
│ │ ├─ 📜 get_activity_detail.cjs JavaScript 202L · 5.8 KB
│ │ ├─ 📜 preview_plan.cjs JavaScript 204L · 5.5 KB
│ │ ├─ 📜 push_plans.cjs JavaScript 321L · 10.4 KB
│ │ ├─ 📜 push_plans.js JavaScript 128L · 3.3 KB
│ │ ├─ 🔧 push_plans.sh Shell 18L · 529 B
│ │ └─ 📜 set-config.cjs JavaScript 65L · 1.6 KB
│ └─ 📝 SKILL.md Markdown 298L · 8.0 KB
├─ ▾ 📁 references
│ ├─ 📝 api-docs.md Markdown 416L · 9.8 KB
│ ├─ 📝 code-format.md Markdown 207L · 4.2 KB
│ └─ 📝 sport-examples.md Markdown 268L · 6.5 KB
├─ ▾ 📁 scripts
│ ├─ 📜 add_feedback_comment.cjs JavaScript 190L · 5.3 KB
│ ├─ 📜 analyze_data.cjs JavaScript 162L · 4.5 KB
│ ├─ 📜 bot-config.cjs JavaScript 209L · 5.0 KB
│ ├─ 📜 bot-router.js JavaScript 52L · 2.0 KB
│ ├─ 📜 configure.cjs JavaScript 89L · 2.2 KB
│ ├─ 📜 fetch_activities.cjs JavaScript 287L · 8.4 KB
│ ├─ 📜 fetch_feedback.cjs JavaScript 247L · 7.1 KB
│ ├─ 📜 fetch_game.cjs JavaScript 193L · 5.2 KB
│ ├─ 📜 fetch_games.cjs JavaScript 175L · 4.7 KB
│ ├─ 📜 fetch_plans.cjs JavaScript 179L · 4.6 KB
│ ├─ 📜 get_activity_detail.cjs JavaScript 202L · 5.8 KB
│ ├─ 📜 preview_plan.cjs JavaScript 204L · 5.5 KB
│ ├─ 📜 push_plans.cjs JavaScript 321L · 10.4 KB
│ ├─ 📜 push_plans.js JavaScript 128L · 3.3 KB
│ ├─ 🔧 push_plans.sh Shell 18L · 529 B
│ └─ 📜 set-config.cjs JavaScript 65L · 1.6 KB
├─ 🔧 install.sh Shell 114L · 3.6 KB
├─ 📝 README.en.md Markdown 314L · 8.7 KB
├─ 📝 README.md Markdown 316L · 8.4 KB
├─ 📝 README.zh.md Markdown 314L · 8.4 KB
└─ 📝 SKILL.md Markdown 309L · 8.4 KB

Security Positives

✓ Core scripts (fetch_activities, push_plans, analyze_data) are well-written and legitimate
✓ API calls use HTTPS to known endpoint (my.likes.com.cn)
✓ No credential harvesting - only accesses LIKES_API_KEY for the training platform
✓ No base64 encoding, obfuscation, or eval() patterns found
✓ No access to ~/.ssh, ~/.aws, or other sensitive credential paths
✓ No data exfiltration to unknown IPs
✓ No reverse shell or RCE capabilities
✓ Configuration properly scoped to skill-specific file (~/.openclaw/likes-training-planner.json)