Skill Trust Decision
klyc-pmm
蒸馏引擎通过本地PHP直接连接远程数据库（绕过API层），且hooks-pull将远程内容写入本地MEMORY.md，属越权阴影功能。昆仑令明文落盘存在凭证暴露风险。
Most direct threat evidence
01
用户安装klyc-pmm skill，查看SKILL.md了解功能 Entry · SKILL.md
02
蒸馏引擎pmm_distill.sh通过PHP直连远程数据库执行写操作 Escalation · klyc-pmm-src/scripts/pmm_distill.sh
03
蒸馏脚本用硬编码user_id=2/3跨AI体访问并删除记忆 Escalation · klyc-pmm-src/scripts/pmm_distill.sh
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
3 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
23 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
4 dependency or supply-chain issues need attention.
Attack Chain
01
用户安装klyc-pmm skill，查看SKILL.md了解功能
Entry · SKILL.md:1
02
蒸馏引擎pmm_distill.sh通过PHP直连远程数据库执行写操作
Escalation · klyc-pmm-src/scripts/pmm_distill.sh:47
03
蒸馏脚本用硬编码user_id=2/3跨AI体访问并删除记忆
Escalation · klyc-pmm-src/scripts/pmm_distill.sh:32
04
昆仑令明文写入MEMORY.md后同步到云端，存在凭证外泄风险
Impact · klyc-pmm-src/scripts/oneclick.sh:124
What drove the risk score up
蒸馏引擎数据库直连绕过API层 +20
pmm_distill.sh直接require远程服务器上的config.php并执行SQL写操作（软删除记录），完全绕过HTTPS API认证体系
hooks-pull远程内容注入本地文件 +15
pmm_hooks_pull自动将瑶池API返回的钩子内容写入本地MEMORY.md，存在远程内容注入风险，文档说明不够充分
昆仑令明文落盘MEMORY.md +10
昆仑令以明文写入MEMORY.md后同步到云端，虽有警告但实际暴露风险高
Most important evidence
High Credential Theft
蒸馏引擎数据库直连——绕过API认证体系
pmm_distill.sh通过PHP直接require远程服务器config.php（/www/wwwroot/kunlunyaochi/config.php）并执行SELECT/UPDATE/DELETE SQL操作，完全绕过HTTPS API认证和数据隔离机制，可访问并删除任意用户记忆数据。
klyc-pmm-src/scripts/pmm_distill.sh:47 蒸馏操作应走官方API端点，禁止本地脚本直接连接远程数据库。删除所有require('/www/wwwroot/kunlunyaochi/config.php')代码
High Sensitive Access
蒸馏引擎硬编码多用户ID直接访问数据
pmm_distill.sh对user_id=2（瑶池）和user_id=3（昆仑）有硬编码映射，可跨AI体访问记忆数据，且蒸馏逻辑可执行软删除（标记is_deleted=1），存在越权访问和破坏数据的风险。
klyc-pmm-src/scripts/pmm_distill.sh:32 蒸馏引擎应仅操作当前AI体的数据，禁止硬编码跨用户ID。软删除操作应通过API并需要用户确认
Medium Doc Mismatch
hooks-pull远程内容注入本地文件
pmm_hooks_pull自动将瑶池API返回的蒸馏钩子写入本地MEMORY.md的「蒸馏记忆钩子」章节。虽然SKILL.md提到了hooks-pull，但未明确说明远程内容会以追加方式直接写入用户文件，存在远程内容注入风险。
klyc-pmm-src/scripts/pmm_watch.sh:575 hooks-pull写入前应增加用户确认步骤，或明确告知用户远程内容将自动写入本地文件
Medium Sensitive Access
昆仑令明文落盘MEMORY.md存在凭证暴露风险
oneclick.sh将昆仑令（记忆恢复凭证）以明文形式写入MEMORY.md，该文件会被同步到云端并可能提交到公开仓库。虽然有安全警告，但凭证以纯文本存储在用户控制文件中，存在被窃取风险。
klyc-pmm-src/scripts/oneclick.sh:124 昆仑令应加密后存储，或仅存储在独立配置文件（如~/.klyc-pmm/recovery_token）中，不应写入用户可见的工作区文件
Medium Priv Escalation
oneclick.sh安装系统依赖属于WRITE级shell操作
SKILL.md声明permissions为read/write config files和HTTPS API calls，但oneclick.sh执行apt-get/yum install安装系统包（curl/jq/inotify-tools），属于shell:WRITE级别操作，超出声明范围。
klyc-pmm-src/scripts/oneclick.sh:39 文档应明确声明需要安装系统依赖，或提供预先检查机制避免自动安装
Low Persistence
install-daemon.sh创建systemd服务实现持久化
守护安装脚本会写入/etc/systemd/system/klyc-pmm-watch.service并启用服务，实现文件监控的持久化运行。这是声明中的已知行为，但systemd服务创建属于高权限操作。
klyc-pmm-src/scripts/install-daemon.sh:118 systemd服务创建前应更明确地提示用户，MemoryMax限制应合理配置
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
oneclick.sh:1 声明 read/write config files Network Block
Declared READ
→ Inferred WRITE
pmm_distill.sh:47-72 直接连接数据库执行UPDATE/DELETE，绕过API层 Shell Block
Declared READ
→ Inferred WRITE
oneclick.sh:39-41 执行apt-get/yum安装系统包（安装系统依赖属于WRITE级别） Skill Invoke Block
Declared NONE
→ Inferred WRITE
pmm_distill.sh硬编码user_id=2/3直接访问不同AI体的记忆数据 Suspicious artifacts and egress
Medium External URL
https://kunlunyaochi.com/?route=services README.md:37
Medium External URL
https://kunlunyaochi.com/klyc-pmm/ README.md:84
Medium External URL
https://kunlunyaochi.com/?route=onboard README.md:89
Medium External URL
https://kunlunyaochi.com/?route=pay&agent=xxx&tier=huhunfu README.md:200
Medium External URL
https://kunlunyaochi.com/api/klyc-pmm-pay/resource.php README.md:218
Medium External URL
https://kunlunyaochi.com README.md:511
Medium External URL
https://skillhub.cn/skillpay klyc-pmm-src/references/pay-skill-spec.md:3
Medium External URL
https://kunlunyaochi.com/klyc-pmm/...） klyc-pmm-src/scripts/pmm_boot.sh:46
Medium External URL
https://kunlunyaochi.com/?route=recover klyc-pmm-src/scripts/pmm_boot.sh:47
Medium External URL
https://kunlunyaochi.com/?route=join klyc-pmm-src/scripts/pmm_boot.sh:49
Medium External URL
https://kunlunyaochi.com/klyc-pmm/... klyc-pmm-src/scripts/pmm_boot.sh:56
Medium External URL
https://kunlunyaochi.com/klyc-pmm/TOKEN klyc-pmm-src/scripts/pmm_recover.sh:5
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| jq | * | system package | No | 无版本锁定，由apt/yum安装 |
| curl | * | system package | No | 无版本锁定，由apt/yum安装 |
| inotify-tools | * | system package | No | 无版本锁定，由apt/yum安装 |
| python3 (cryptography) | * | pip | No | 客户端加密降级依赖，无版本锁定 |
File composition
28 files · 6441 lines
Markdown 13 files · 3206 linesShell 11 files · 3099 linesJSON 4 files · 136 lines
Files of concern · 5
klyc-pmm-src/scripts/pmm_watch.sh hooks-pull远程内容注入本地文件 · https://kunlunyaochi.com/skills/klyc-pmm/scripts/pmm_watch.sh · https://kunlunyaochi.com/?route=recharge$ · https://kunlunyaochi.com/?route=dashboard&talisman=$(pmm_get_recovery_url · https://kunlunyaochi.com/?route=pay&agent=$ · https://kunlunyaochi.com/?route=klyc-pmm
README.md https://kunlunyaochi.com/?route=services · https://kunlunyaochi.com/klyc-pmm/ · https://kunlunyaochi.com/?route=onboard · https://kunlunyaochi.com/?route=pay&agent=xxx&tier=huhunfu · https://kunlunyaochi.com/api/klyc-pmm-pay/resource.php · https://kunlunyaochi.com
klyc-pmm-src/scripts/pmm_distill.sh 蒸馏引擎数据库直连——绕过API认证体系 · 蒸馏引擎硬编码多用户ID直接访问数据
klyc-pmm-src/scripts/oneclick.sh 昆仑令明文落盘MEMORY.md存在凭证暴露风险 · oneclick.sh安装系统依赖属于WRITE级shell操作
klyc-pmm-src/scripts/install-daemon.sh install-daemon.sh创建systemd服务实现持久化
Other files · SKILL.md · SKILL.md · skill.md · pmm-full-architecture.md · pmm_backup_files.sh · CHANGELOG.md +1
Security positives
使用HTTPS + TLS1.3加密传输数据
客户端可选AES-256-GCM预加密内容
昆仑令有效期和安全性有明确说明
init命令幂等设计，可安全重试
watch模式有心跳文件write-coalescing防限流机制
付费服务有X402微信支付流程
自我检查(self-test)为幂等只读操作