中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 0/100
上次扫描：20 小时前 重新扫描
0 /100
video-resizer
OpenClaw skill for Sparki AI video editing - aspect-ratio and platform-format conversion
Legitimate video editing CLI tool with clean codebase, well-documented behavior, and no security issues detected.
技能名称video-resizer
分析耗时30.2s
引擎pi
✓
可以安装
This skill is safe to use. No action required.
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 cli.py:178 - opens user-provided video files for upload
文件系统 WRITE WRITE ✓ 一致 client.py:108 - streams downloads to output_path; config.py:44 - writes config t…
网络访问 READ READ ✓ 一致 client.py - all HTTP calls use httpx to agent-api.sparki.io only
命令执行 NONE NONE — No subprocess, os.system, or shell execution found
环境变量 NONE READ ✓ 一致 config.py:20 - reads SPARKI_API_KEY env var (legitimate, documented in _meta.jso…
7 项发现
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/ClawHub-Skill-blueviolet
README.md:3
🔗
中危 外部 URL 外部 URL
https://clawhub.io
README.md:3
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/version-1.0.12-blue
README.md:4
🔗
中危 外部 URL 外部 URL
https://sparki.io
SKILL.md:17
🔗
中危 外部 URL 外部 URL
https://agent-api.sparki.io
src/sparki_cli/constants.py:61
🔗
中危 外部 URL 外部 URL
https://t.me/Sparki_AI_bot/upload
src/sparki_cli/constants.py:62
🔗
中危 外部 URL 外部 URL
https://sparki.io/pricing
src/sparki_cli/constants.py:101

目录结构

11 文件 · 33.3 KB · 1010 行
Python 7f · 904L Markdown 2f · 71L TOML 1f · 31L JSON 1f · 4L
├─ ▾ 📁 src
│ └─ ▾ 📁 sparki_cli
│ ├─ 🐍 __init__.py Python 3L · 81 B
│ ├─ 🐍 cli.py Python 507L · 17.1 KB
│ ├─ 🐍 client.py Python 99L · 4.0 KB
│ ├─ 🐍 config.py Python 55L · 1.9 KB
│ ├─ 🐍 constants.py Python 139L · 4.8 KB
│ ├─ 🐍 models.py Python 59L · 1.3 KB
│ └─ 🐍 output.py Python 42L · 1.0 KB
├─ 📋 _meta.json JSON 4L · 53 B
├─ 📄 pyproject.toml TOML 31L · 579 B
├─ 📝 README.md Markdown 28L · 1014 B
└─ 📝 SKILL.md Markdown 43L · 1.5 KB

依赖分析 3 项

包名版本来源已知漏洞备注
typer >=0.9.0 pip 否 Legitimate CLI framework
httpx >=0.27.0 pip 否 Legitimate HTTP client
pydantic >=2.0.0 pip 否 Legitimate data validation library

安全亮点

✓ No subprocess, shell execution, or command injection vectors
✓ No base64 encoding/decoding or code obfuscation
✓ No credential exfiltration - API key is stored locally, not transmitted elsewhere
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env files)
✓ No remote script execution (curl|bash, wget|sh)
✓ No eval(), exec(), or dynamic code execution
✓ No hidden functionality - all operations are visible in CLI commands
✓ Dependencies (typer, httpx, pydantic) are reputable and well-known
✓ Network communication restricted to declared domain (agent-api.sparki.io)
✓ Filesystem access limited to declared paths (CWD for reads, openclaw config dirs for writes)
✓ API key read from environment variable is standard, documented behavior