Skill Trust Decision
asoul-support
合法的B站粉丝应援工具，存在一处未声明的Discord通知功能（阴影功能），但不涉及凭证外泄或恶意行为。
Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
What drove the risk score up
未声明的阴影功能 +15
heartbeat.py中的_notify()函数通过subprocess调用openclaw发送Discord通知，但SKILL.md未声明此功能
硬编码IP地址 +5
131.0.0.0是TEST-NET保留地址，用于User-Agent字符串，非真实连接目标
凭证本地存储 +2
Cookie存储在.cookies.json(权限0600)，虽未加密但为常见做法，无外传行为
Most important evidence
Medium Doc Mismatch
Discord通知功能未在文档中声明
heartbeat.py中的_notify()函数会通过subprocess调用openclaw向Discord发送开播/下播通知，但SKILL.md未提及此功能。目标用户ID 1479415368249507881硬编码在代码中。
scripts/heartbeat.py:31 在SKILL.md的推荐定时任务部分说明会自动发送Discord通知，或移除此功能
Low Credential Theft
Cookie明文存储在本地文件
SESSDATA和bili_jct以明文JSON格式存储在.cookies.json，权限设置为0600。虽然是常见做法，但理想情况下应使用系统密钥链。
scripts/checkin.py:45 考虑使用keyring或系统密钥链存储凭证，而非明文文件
Info Sensitive Access
访问本地日志目录
daily_summary.py读取~/.openclaw/logs/asoul_activity.jsonl，heartbeat.py写入同一文件。这是正常功能。
scripts/daily_summary.py:14 无需操作，这是预期行为
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred WRITE
SKILL.md声明文件操作，代码读写.cookies.json Network Pass
Declared READ
→ Inferred READ
仅调用B站官方API，无未声明网络行为 Shell Pass
Declared NONE
→ Inferred WRITE
heartbeat.py:35调用subprocess发送Discord通知 Suspicious artifacts and egress
High IP Address
131.0.0.0 scripts/checkin.py:18
Medium External URL
https://openclaw.ai PROMO.md:5
Medium External URL
https://docs.openclaw.ai PROMO.md:17
Medium External URL
https://www.bilibili.com PROMO.md:27
Medium External URL
https://www.bilibili.com」 PROMO_XHS.txt:44
Medium External URL
https://clawhub.ai/skills/asoul-support README.md:12
Medium External URL
https://img.shields.io/badge/version-4.0.1-blue README.md:17
Medium External URL
https://img.shields.io/badge/python-3.9+-green README.md:18
Medium External URL
https://img.shields.io/badge/license-MIT-orange README.md:19
Medium External URL
https://space.bilibili.com/672328094/ README.md:81
Medium External URL
https://www.bilibili.com**，找到 README.md:131
Medium External URL
https://live.bilibili.com/22637261 README.md:181
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| 无外部依赖 | N/A | Python标准库 | No | 零外部依赖 |
File composition
14 files · 2869 lines
Python 5 files · 2061 linesMarkdown 5 files · 560 linesText 2 files · 238 linesJSON 2 files · 10 lines
Files of concern · 8
scripts/heartbeat.py Discord通知功能未在文档中声明 · https://api.live.bilibili.com/room/v1/Room/get_info?room_id= · https://api.live.bilibili.com/xlive/web-room/v1/index/roomEntryAction · https://live-trace.bilibili.com/xlive/data-interface/v1/heartbeat/mobileHeartBeat · https://api.live.bilibili.com/User/userOnlineHeart · [email protected]
scripts/videos.py https://api.bilibili.com/x/web-interface/nav · https://api.bilibili.com/x/space/wbi/arc/search? · https://api.bilibili.com/x/web-interface/archive/like · https://api.bilibili.com/x/web-interface/coin/add · https://api.bilibili.com/x/v3/fav/resource/deal · https://api.bilibili.com/x/v3/fav/folder/created/list-all?up_mid= · https://www.bilibili.com/video/
scripts/checkin.py Cookie明文存储在本地文件 · 131.0.0.0 · https://api.live.bilibili.com/msg/send · https://api.live.bilibili.com/room/v1/Room/get_status_info_by_uids · https://live.bilibili.com · https://api.live.bilibili.com/xlive/app-ucenter/v1/fansMedal/panel?page= · https://api.live.bilibili.com/xlive/web-room/v1/fansMedal/wear · https://live.bilibili.com/
scripts/dynamics.py https://space.bilibili.com/ · https://api.bilibili.com/x/polymer/web-dynamic/v1/feed/space?host_mid= · https://api.vc.bilibili.com/dynamic_like/v1/dynamic_like/thumb · https://t.bilibili.com · https://t.bilibili.com/
README.md https://clawhub.ai/skills/asoul-support · https://img.shields.io/badge/version-4.0.1-blue · https://img.shields.io/badge/python-3.9+-green · https://img.shields.io/badge/license-MIT-orange · https://space.bilibili.com/672328094/ · https://www.bilibili.com**，找到 · https://live.bilibili.com/22637261 · https://space.bilibili.com/672328094 · https://live.bilibili.com/22632424 · https://space.bilibili.com/672353429 · https://live.bilibili.com/22625027 · https://space.bilibili.com/672342685 · https://live.bilibili.com/30849777 · https://space.bilibili.com/3537115310721181 · https://live.bilibili.com/30858592 · https://space.bilibili.com/3537115310721781
PROMO_XHS.txt https://www.bilibili.com」
scripts/daily_summary.py 访问本地日志目录
PROMO.md https://openclaw.ai · https://docs.openclaw.ai · https://www.bilibili.com
Other files · persona.md · SKILL.md · text2speech.md · PROMO_XHS_V4.txt
Security positives
纯Python标准库实现，零外部依赖，无供应链风险
所有网络请求仅发往B站官方API(api.bilibili.com, live.bilibili.com等)
凭证(SESSDATA, bili_jct)仅用于B站API认证，无外传行为
代码结构清晰，注释完整，无混淆代码
使用WBI签名实现B站API调用，无需Node.js依赖
Cookie文件权限设置为0600，权限控制合理