Name: gpt-chat Security Report — Suspicious | ClawSafe
Item: gpt-chat
Rating: 65
Author: ClawSafe

This report was generated in Chinese. Some content may be in Chinese.

35 /100

gpt-chat

GPT聊天 - 使用GPT模型进行对话和内容生成

发现多处文档未声明的阴影功能(server.js HTTP服务器、generate-article.js文件写入)，存在doc_deception特征但无明显恶意行为证据

Skill Namegpt-chat

Duration33.0s

Enginepi

ClawHub 调用closeai的gpt v1.0.0 by lilisidu1210-ui

📥 236 📦 1

ClawHub Verdict Suspicious env_credential_accessllm_suspiciousvt_suspicious

⚠

Use with caution

要求开发者补充完整文档，明确声明所有脚本功能；server.js监听端口3456且无认证，建议移除或明确警告

Findings 4 items

Severity	Finding	Location
Medium	未声明的HTTP服务器 Doc Mismatch server.js提供本地HTTP服务监听3456端口，包含/chat、/set-model等端点，Access-Control-Allow-Origin:*允许跨域请求，无认证机制 server.listen(PORT, () => { console.log(`GPT Model Selector running on port ${PORT}`); }); → 如非必要功能建议删除；如需保留必须在文档明确声明并添加认证	`scripts/server.js:47`
Medium	未声明的文件写入操作 Doc Mismatch generate-article.js会将生成的Markdown文章写入当前工作目录的ai-future-article.md文件 `fs.writeFileSync(filename, content);` → 在SKILL.md中声明文件写入能力，说明输出文件路径	`scripts/generate-article.js:57`
Low	依赖版本未锁定 Supply Chain package.json中无dependencies和devDependencies定义，任何依赖更新可能导致兼容性问题 `{}` → 补充完整依赖声明及版本范围	`package.json:1`
Low	测试脚本未声明 Doc Mismatch test.js、test-chat.js、test-key.js为测试文件，未在文档中说明 `//测试脚本` → 测试脚本应移至test/目录或在README中说明	`scripts/:1`

Resource	Declared	Inferred	Status	Evidence
Network	`READ`	`WRITE`	✗ Violation	SKILL.md未声明server.js的HTTP服务端口3456
Filesystem	`NONE`	`WRITE`	✗ Violation	generate-article.js:57 fs.writeFileSync写入本地文件
Environment	`READ`	`READ`	✓ Aligned	gpt.js:7读取OPENAI_API_KEY

1 findings

🔗

Medium External URL 外部 URL

https://api.openai-proxy.org

scripts/gpt.js:11

File Tree

9 files · 14.1 KB · 530 lines

JavaScript 6f · 455L Markdown 1f · 60L JSON 2f · 15L

├─ ▾ 📁 scripts

│ ├─ 📜 generate-article.js JavaScript 73L · 1.9 KB

│ ├─ 📜 gpt.js JavaScript 136L · 3.9 KB

│ ├─ 📜 server.js JavaScript 130L · 3.6 KB

│ ├─ 📋 state.json JSON 2L · 31 B

│ ├─ 📜 test-chat.js JavaScript 49L · 1.2 KB

│ ├─ 📜 test-key.js JavaScript 31L · 817 B

│ └─ 📜 test.js JavaScript 36L · 754 B

├─ 📋 package.json JSON 13L · 338 B

└─ 📝 SKILL.md Markdown 60L · 1.5 KB

Package	Version	Source	Known Vulns	Notes
`无显式依赖`	`N/A`	package.json	No	仅使用Node.js内置模块(fs, https, http, url, path)

✓ 代码结构清晰，无明显混淆或恶意编码

✓ 环境变量读取符合声明(OPENAI_API_KEY)

✓ 未发现凭证收割、远程代码执行等高危行为

✓ API调用逻辑正常，无C2通信特征