302ai-api-integration 安全扫描报告 — 低风险 | ClawSafe

15 /100

302ai-api-integration

Automatically search 302.AI's 1400+ APIs and generate integration code for AI models, image generation, video, audio, and text processing

This is a legitimate 302.AI API integration skill with no malicious behavior. All functionality is declared and aligned with documented behavior.

技能名称302ai-api-integration

分析耗时35.7s

引擎pi

✓

可以安装

No action required. The skill is safe to use as documented.

安全发现 1 项

严重性	安全发现	位置
低危	Placeholder API Keys in Documentation 文档欺骗 Documentation files contain 'API_KEY = your_api_key_here' placeholders in code examples. These are clearly instructional examples, not actual credentials, but could be mistaken for hardcoded secrets by automated scanners. `API_KEY = 'your_api_key_here'` → Consider adding a comment like '# REPLACE WITH YOUR ACTUAL API KEY' or 'API_KEY = os.environ.get("API_KEY")' to make it clearer these are placeholders	`references/integration_examples.md:106`

资源类型	声明权限	推断权限	状态	证据
网络访问	`READ`	`READ`	✓ 一致	scripts/parse_api_list.py fetches from https://doc.302.ai/llms.txt - declared in…
命令执行	`WRITE`	`WRITE`	✓ 一致	SKILL.md declares bash usage: 'python3 scripts/parse_api_list.py' - script is re…
文件系统	`READ`	`READ`	✓ 一致	Script reads no files, only fetches remote content
环境变量	`NONE`	`NONE`	—	No environment variable access detected
技能调用	`NONE`	`NONE`	—	No cross-skill invocation observed
剪贴板	`NONE`	`NONE`	—	No clipboard access detected
浏览器	`NONE`	`NONE`	—	No browser access detected
数据库	`NONE`	`NONE`	—	No database access detected

3 高危 17 项发现

🔑

高危 API 密钥疑似硬编码凭证

API_KEY = "your_api_key_here"

README.md:94

🔑

高危 API 密钥疑似硬编码凭证

API_KEY = 'your_api_key_here'

references/integration_examples.md:106

🔑

高危 API 密钥疑似硬编码凭证

APIKey = "your_api_key_here"

references/integration_examples.md:286

🔗

中危外部 URL 外部 URL

https://img.shields.io/badge/License-Apache%202.0-blue.svg

README.md:13

🔗

中危外部 URL 外部 URL

https://opensource.org/licenses/Apache-2.0

README.md:13

🔗

中危外部 URL 外部 URL

https://img.shields.io/badge/Claude-Code-blue.svg

README.md:14

🔗

中危外部 URL 外部 URL

https://claude.com/claude-code

README.md:14

🔗

中危外部 URL 外部 URL

https://img.shields.io/badge/APIs-1400%2B-green.svg

README.md:15

🔗

中危外部 URL 外部 URL

https://doc.302.ai/

README.md:15

🔗

中危外部 URL 外部 URL

https://api.302.ai

README.md:95

🔗

中危外部 URL 外部 URL

https://doc.302.ai/147522039e0.md

SKILL.md:152

🔗

中危外部 URL 外部 URL

https://doc.302.ai/xxxxxxxxx.md

SKILL.md:157

🔗

中危外部 URL 外部 URL

https://doc.302.ai/llms.txt

SKILL.md:407

🔗

中危外部 URL 外部 URL

https://api.302.ai/v1/endpoint

references/integration_examples.md:194

🔗

中危外部 URL 外部 URL

https://api.302.ai/v1/stream-endpoint

references/integration_examples.md:206

🔗

中危外部 URL 外部 URL

https://doc.302.ai/147522039e0.md）

scripts/parse_api_list.py:120

📧

提示邮箱邮箱地址

[email protected]

README.md:252

目录结构

8 文件 · 52.6 KB · 1994 行

Markdown 6f · 1779L Python 1f · 215L

├─ ▾ 📁 references

│ ├─ 📝 api_categories.md Markdown 190L · 3.2 KB

│ ├─ 📝 integration_examples.md Markdown 369L · 8.7 KB

│ └─ 📝 parse_script_usage.md Markdown 202L · 4.9 KB

├─ ▾ 📁 scripts

│ └─ 🐍 parse_api_list.py Python 215L · 5.8 KB

├─ 📦 icon.svg 2.0 KB

├─ 📝 README_CN.md Markdown 271L · 7.0 KB

├─ 📝 README.md Markdown 273L · 7.5 KB

└─ 📝 SKILL.md Markdown 474L · 13.4 KB

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`requests`	`unspecified`	stdlib-equivalent	否	requests is used without explicit version pinning but is a widely-used standard library

安全亮点

✓ No malicious code patterns detected (no base64, no obfuscation, no eval)

✓ All shell/network access is explicitly declared in SKILL.md

✓ Clean, readable Python code with proper error handling

✓ Script fetches from legitimate, declared 302.AI endpoints only

✓ No credential harvesting from environment variables or sensitive paths

✓ No data exfiltration or C2 communication patterns

✓ No persistence mechanisms or backdoors

✓ No supply chain risks - uses standard requests library with version flexibility