中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：20 小时前 重新扫描
5 /100
smartpi-iot
智能公元 IoT 设备控制插件。可控制灯光、加湿器、窗帘等设备，支持查询设备状态。
This is a pure-documentation IoT device control skill with no executable code, no scripts, and no hidden functionality — all network access is explicitly declared via curl commands documented in SKILL.md.
技能名称smartpi-iot
分析耗时26.4s
引擎pi
✓
可以安装
No action needed. The skill is safe to use. Consider pinning the curl version for reproducibility.

安全发现 2 项

严重性 安全发现 位置
低危
Hardcoded device ID in all API examples 文档欺骗
All curl command examples contain the hardcoded device ID 1773819411753. While this makes the examples immediately copy-pasteable, it suggests these are real operational examples rather than generic templates. Users should be warned to replace this with their own device ID.
curl -X POST https://mcp.aimachip.com/plugin/control/switch_1/1773819411753
→ Replace the hardcoded ID with a placeholder like YOUR_DEVICE_ID in documentation examples.
 SKILL.md:72
低危
Credentials exposed in curl command history 敏感访问
API tokens (SMARTPI_TOKEN) and device keys are embedded directly in curl command-line arguments, which means they can appear in shell history files (~/.bash_history) and process listings (ps).
..."token": "'\$SMARTPI_TOKEN'"...
→ Consider documenting the use of a session cookie or OAuth flow instead of embedding tokens in every request. Alternatively, document how to set a HISTIGNORE pattern for these commands.
 SKILL.md:72
资源类型声明权限推断权限状态证据
网络访问 READ READ ✓ 一致 SKILL.md: all curl commands use POST to https://mcp.aimachip.com for device cont…
命令执行 WRITE NONE ✓ 一致 SKILL.md metadata declares requires.bins: ['curl'], but no actual shell executio…
文件系统 NONE NONE — No file reads or writes referenced; iot-control.sh script is only a documentatio…
环境变量 READ READ ✓ 一致 SKILL.md declares SMARTPI_TOKEN and SMARTPI_DEVICE_KEY env vars; values are used…
技能调用 NONE NONE — No cross-skill invocation observed
剪贴板 NONE NONE — No clipboard access
浏览器 NONE NONE — No browser access
数据库 NONE NONE — No database access
10 项发现
🔗
中危 外部 URL 外部 URL
https://smartpi.cn/
SKILL.md:6
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com
SKILL.md:60
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com/plugin/control/switch_1/1773819411753
SKILL.md:72
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com/plugin/query/switch_1/1773819411753
SKILL.md:88
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com/plugin/control/slider_1/1773819411753
SKILL.md:100
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com/plugin/query/slider_1/1773819411753
SKILL.md:116
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com/plugin/control/power_1/1773819411753
SKILL.md:132
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com/plugin/query/power_1/1773819411753
SKILL.md:148
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com/plugin/control/switch_2/1773819411753
SKILL.md:164
🔗
中危 外部 URL 外部 URL
https://mcp.aimachip.com/plugin/query/switch_2/1773819411753
SKILL.md:180

目录结构

1 文件 · 6.8 KB · 305 行
Markdown 1f · 305L
└─ 📝 SKILL.md Markdown 305L · 6.8 KB

安全亮点

✓ No executable code or scripts present — only documentation
✓ No dependencies (no requirements.txt, package.json, etc.) — no supply chain risk
✓ All network access is explicitly documented via curl commands
✓ No obfuscation, base64, or hidden instructions
✓ No sensitive file/directory access (no ~/.ssh, ~/.aws, .env reads)
✓ No credential exfiltration — tokens only sent to the declared API endpoint
✓ No reverse shell, C2, or data theft patterns
✓ No prompt injection or hidden instructions
✓ MIT license declared with author attribution
✓ Credential security warning present (do not commit tokens to version control)