中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:1 day ago Rescan
20 /100
claim-risk-auditor
检查文案、论文、宣传稿或产品说明中的高风险断言，标出证据缺口并给出更稳妥的改写
A straightforward clipboard-reading utility for macOS that accurately declares its shell:WRITE permission and performs only read-only pbpaste execution with no hidden behavior.
Skill Nameclaim-risk-auditor
Duration25.3s
Enginepi
✓
Safe to install
No action required. The skill is straightforward and its declared shell:WRITE permission is necessary for reading clipboard via pbpaste. Consider pinning node dependency and restricting permission to shell:READ if the tool allows it.

Findings 2 items

Severity Finding Location
Low
Clipboard read not declared in metadata Priv Escalation
The script reads clipboard content via pbpaste but SKILL.md metadata does not declare clipboard:READ as a required permission. This is a minor omission as the purpose is transparent and the behavior is documented in the script body.
return execSync('pbpaste', { encoding: 'utf8' }).trim();
→ Add clipboard:READ to the allowed-tools mapping in the capability model or document it in SKILL.md metadata.
 scripts/read_clipboard.mjs:6
Low
shell:WRITE permission is inflated Priv Escalation
The metadata declares shell:WRITE but the script only executes pbpaste, a read-only command. A read-only shell or exec permission would be sufficient.
execSync('pbpaste', ...)
→ If the tool framework supports shell:READ, use that instead to accurately reflect the minimal privilege principle.
 scripts/read_clipboard.mjs:6
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file reads or writes found
Network NONE NONE — No network requests found
Shell WRITE READ (read-only pbpaste) ✓ Aligned scripts/read_clipboard.mjs:6 — execSync runs 'pbpaste' which only reads clipboar…
Environment NONE NONE — No environment variable access
Clipboard NONE READ ✓ Aligned scripts/read_clipboard.mjs:6 — reads clipboard via pbpaste; clipboard:READ not d…

File Tree

4 files · 1.7 KB · 84 lines
Markdown 3f · 65L JavaScript 1f · 19L
├─ ▾ 📁 scripts
│ └─ 📜 read_clipboard.mjs JavaScript 19L · 445 B
├─ 📝 CHANGELOG.md Markdown 6L · 114 B
├─ 📝 README.md Markdown 26L · 379 B
└─ 📝 SKILL.md Markdown 33L · 771 B

Security Positives

✓ No network requests or data exfiltration
✓ No credential harvesting or environment variable access
✓ No obfuscation, base64, or anti-analysis patterns
✓ No sensitive file or path access (~/.ssh, ~/.aws, .env)
✓ Script is short (19 lines) and easy to audit
✓ No external dependencies or npm packages
✓ Script behavior fully aligns with SKILL.md description
✓ No hidden functionality beyond stated purpose
✓ Includes proper error handling for empty clipboard