chapter-outliner 安全扫描报告 — 可信 | ClawSafe

5 /100

chapter-outliner

章节大纲生成器 - 基于15节拍系统生成小说章节大纲

Chapter Outliner is a benign creative writing tool with no malicious behavior, credential access, network calls, or hidden functionality.

技能名称chapter-outliner

分析耗时32.8s

引擎pi

✓

可以安装

This skill is safe for use. Consider pinning dependencies to versions for reproducible builds.

安全发现 1 项

严重性	安全发现	位置
低危	Dependencies not version-pinned 供应链 requirements.txt lists 'rich' and 'PyYAML' without version constraints. This could lead to unexpected behavior if unpinned latest versions introduce breaking changes. `rich PyYAML` → Pin to known-good versions, e.g. 'rich>=13.0.0' and 'PyYAML>=6.0'	`scripts/requirements.txt:1`

资源类型	声明权限	推断权限	状态	证据
文件系统	`READ`	`READ`	✓ 一致	SKILL.md declares book-dir parameter; code reads outline.md, style.yml, and char…
文件系统	`WRITE`	`WRITE`	✓ 一致	SKILL.md declares --output parameter; code writes markdown output to specified p…
网络访问	`NONE`	`NONE`	—	No network calls in generate_outline.py; no requests, urllib, or socket usage
命令执行	`NONE`	`NONE`	—	No subprocess, os.system, or shell command execution in code
环境变量	`NONE`	`NONE`	—	No os.environ access; all parameters come from CLI args
技能调用	`NONE`	`NONE`	—	No skill invocation chain; standalone script
剪贴板	`NONE`	`NONE`	—	No clipboard access
浏览器	`NONE`	`NONE`	—	No browser or web automation
数据库	`NONE`	`NONE`	—	No database access

3 文件 · 19.3 KB · 635 行

Python 1f · 465L Markdown 1f · 168L Text 1f · 2L

├─ ▾ 📁 scripts

│ ├─ 🐍 generate_outline.py Python 465L · 15.3 KB

│ └─ 📄 requirements.txt Text 2L · 12 B

└─ 📝 SKILL.md Markdown 168L · 4.0 KB

包名	版本	来源	已知漏洞	备注
`rich`	`*`	pip	否	Version not pinned — minor supply chain risk
`PyYAML`	`*`	pip	否	Version not pinned — minor supply chain risk

✓ No network requests — offline-only operation

✓ No credential or sensitive file access

✓ No subprocess or shell execution

✓ No obfuscation, base64, or eval patterns

✓ Documentation fully matches code behavior — no doc-to-code mismatch

✓ Uses yaml.safe_load() — safe YAML parsing

✓ File writes are user-controlled via explicit --output flag

✓ Input paths are validated with .exists() and .is_dir() checks

✓ Clean error handling with user-friendly messages