2 medium findings.

This skill spawns subprocesses outside its declared capabilities plus 1 other issue listed below.

0 critical0 high2 medium10 rules passed

Why grade A?

score · 95 / 100

The current grade reflects 2 minor findings below all thresholds.

0 CRIT0 HIGH2 MED0 LOW

Already at the top grade — no further rules to pass.

Findings · ordered by severity

med

Arbitrary subprocess execution detected

The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.

rule: subprocess-executionline: 277CWE-78

▾

275- 0.7.x：`login` 在前台阻塞 5 分钟轮询。被 IDE / agent shell wrapper（Cursor / Claude / OpenClaw 等）包起来时，wrapper 把长任务标成已完成 / 转后台，输出全部丢失，用户以为失败。

276- 0.8.x：`login` 改成 fire-and-forget + 后台 daemon。前台 ~1s 退出，daemon 自动写凭证；后台进程难以审计，已弃用。

277- **0.9.0：checkpoint-file 模型。** 没有后台进程，没有 child_process。`login` 写 pending 文件就退出；`login-status` 读 pending → 一次性 poll → 写凭证。流程更简单、可审计。← spawns a subprocess outside declared capabilities

278

279AI 必须按这两步走：

med

No capability manifest declared

The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.

rule: no-manifest

▾

Scan another →Share

skillox.io/r/crawl-wcsovd4f4b0kluqaezml7ymz