安全决策报告

ct-advisor

Name: ct-advisor 可信度判断报告
Item: ct-advisor
Rating: 80
Author: ClawSafe

A legitimate clinical-trial methodology advisor that forwards non-vague questions to a public Coze cloud endpoint, with sibling-skill delegation, hardware-ID tracking, and obfuscated shared credentials — all with documented rationale, no hidden malicious functionality, and no credential-harvest or data-exfiltration chains.

安装决策优先来源: ClawHub 扫描时间: 2026/9/19

文件 86

IOC 60

越权项 2

发现 3

为什么得出这个结论

1/4 个维度触发

阻止

声明与实际能力

发现 2 项声明之外的能力或越权行为。

复核

隐藏执行与外联

提取到 60 个一般风险产物，需要结合上下文判断。

通过

攻击链与高危发现

没有形成明确的恶意路径。

复核

依赖与供应链卫生

发现 1 项需要关注的依赖或供应链线索。

风险分是怎么被拉高的

Embedded obfuscated tokens without explicit SKILL.md callout +10

adapters/coze_token_embedded.py embeds XOR+base64 obfuscated tokens for ct-advisor.coze.site/run and ct-bugreport.coze.site/run. The obfuscation key is hardcoded in the same file. SKILL.md discloses the network path but does not explicitly call out 'credentials embedded as obfuscated blobs in Python'. Tokens are for a public shared Coze bot (not a personal account), so the impact of disclosure is bounded, and the code comments explain the design rationale.

Hardware-ID machine fingerprinting +5

scripts/hardware_id.py reads SMBIOS UUID (Windows), IOPlatformUUID (macOS), or machine-id (Linux) and sends sha256:... as query_origin. Rationale (stable, non-reversible machine ID for audit/limit) is documented in code and AGENTS.md. Disclosure is non-PII, but explicit mention in SKILL.md permissions section would be cleaner.

auto_approve_endpoints whitelist pre-loaded +5

config.json ships with both ct-advisor.coze.site/run and ct-bugreport.coze.site/run pre-whitelisted. AGENTS.md §4.1 explains this is author-preset and that the agent must never edit config.json. Since both endpoints are the skill's intended outbound paths, pre-approval is functionally correct, but the large volume of documentation makes the whitelist easy to miss.

最关键的证据

低危文档欺骗

Embedded obfuscated credentials lack explicit SKILL.md callout

adapters/coze_token_embedded.py contains XOR+base64 obfuscated tokens for two Coze endpoints, with the obfuscation key hardcoded in the same file. SKILL.md network_note discloses the outbound path but does not explicitly mention 'credentials embedded as obfuscated Python blobs'. The tokens are for a public shared Coze bot (not a personal account), and the code comments explain the design rationale, but explicit documentation in SKILL.md would close the minor doc gap.

adapters/coze_token_embedded.py:32

Add a 'Credential handling' subsection to SKILL.md permissions section, e.g.: 'API tokens for ct-advisor.coze.site/run and ct-bugreport.coze.site/run are embedded as XOR+base64 obfuscated blobs in adapters/coze_token_embedded.py. These are public shared bot tokens (not personal account keys). Obfuscation prevents casual browsing exposure; the key is in the same file, so the tokens are not secrets in the cryptographic sense.'

低危敏感访问

Hardware-ID machine fingerprinting without prominent SKILL.md disclosure

scripts/hardware_id.py reads SMBIOS UUID (Windows), IOPlatformUUID (macOS), or /etc/machine-id (Linux) and sends sha256:<64-hex> as query_origin in outbound payloads. The rationale (stable, non-reversible device ID for audit/limit) is in code comments and AGENTS.md, but SKILL.md does not call it out in the permissions block, making the disclosure easy to miss.

scripts/hardware_id.py:21

Add 'hardware_id (sha256 of SMBIOS/machine-id, non-reversible, disclosed to user)' to the SKILL.md permissions section network_note paragraph.

提示文档欺骗

auto_approve_endpoints whitelist is author-preset and pre-loaded

config.json ships with two endpoints pre-whitelisted: ct-advisor.coze.site/run and ct-bugreport.coze.site/run. AGENTS.md §4.1 explicitly prohibits the agent from editing config.json and explains the whitelist is author-preset. The pre-approval is functionally correct (both are the skill's intended endpoints), but the large SKILL.md volume means this detail is buried.

config.json:7

Add a one-liner in SKILL.md permissions section: 'auto_approve_endpoints includes the two Coze endpoints above (pre-authorized by the author; the agent cannot modify this list per AGENTS.md §4.1).'

声明能力 vs 实际能力

文件系统 通过

声明 READ

→

推断 READ

SKILL.md: 'Read-only to own files (writes only config.json + optional data/qa_log.jsonl, off by default)'

网络访问 通过

声明 controlled-coze-opt-in

→

推断 WRITE

SKILL.md declares controlled-coze-opt-in; network:WRITE to ct-advisor.coze.site/run (main path) and ct-bugreport.coze.site/run (optional bug report); outbound payload is sanitized (adapters/sanitize.py strips PII and tokens)

命令执行 阻止

声明 NONE

→

推断 WRITE

scripts/handle_need_tool.py line ~400: subprocess.run() executes sibling skill CLI commands; execution boundary validation (_execution_boundary_violation) restricts to python/rscript + paths inside SKILLS_DIR. Shell access is gated by tool_mapping.json whitelist and user-consent install flow.

环境变量 阻止

声明 NONE

→

推断 READ

adapters/coze_token_embedded.py reads CT_ADVISOR_COZE_TOKEN env var; hardware_id.py reads machine-id; sanitize.py scans for secret-key-named dict keys. No credential exfiltration — only local resolution.

技能调用 通过

声明 controlled

→

推断 WRITE

Sibling skills (ct-registry/safety/literature/samplesize) are invoked via need_tool card execution (subprocess), with A/B tier gate, user-consent install flow, and install_mode=suggest (never auto-install) per SKILL.md and handle_need_tool.py

剪贴板 通过

声明 NONE

→

推断 NONE

No clipboard access found in codebase

浏览器 通过

声明 NONE

→

推断 NONE

No browser automation found in codebase

数据库 通过

声明 NONE

→

推断 NONE

No database access found in codebase

可疑产物与外联

中危外部 URL

https://ct-bugreport.coze.site/run

AGENTS.md:62

中危外部 URL

http://lb-*.clb.gz-tencentclb.com

CHANGELOG.md:297

中危外部 URL

https://ct-advisor.coze.site/run

CHANGELOG.md:1139

中危外部 URL

http://127.0.0.1:10808/

CHANGELOG.md:1344

中危外部 URL

https://api.coze.cn/v1/chat

adapters/backend.py:77

中危外部 URL

https://api.skillhub.cn/api/v1/search

adapters/install_sibling.py:51

中危外部 URL

https://api.skillhub.cn/api/v1/download

adapters/install_sibling.py:52

中危外部 URL

https://www.nccn.org/profelines/immunotherapy

knowledge/ref-icae-safety.md:6

中危外部 URL

https://www.hematology.org/clinicians

knowledge/ref-icae-safety.md:7

中危外部 URL

https://pubmed.ncbi.nlm.nih.gov

knowledge/ref-icae-safety.md:8

中危外部 URL

https://www.ich.org/

knowledge/ref-interaction-style.md:79

中危外部 URL

https://www.ich.org/page/search-index-ich-guidelines

knowledge/ref-interaction-style.md:79

依赖与供应链

包名	版本	来源	漏洞	备注
requests	`2.32.3`	pip	否	Version is pinned; imported lazily only when an outbound Coze call is made; missing import triggers a manual-install prompt (no auto-pip install)

文件构成

86 个文件 · 24023 行

Python 40 个文件 · 11361 行JSON 11 个文件 · 6382 行Markdown 33 个文件 · 6259 行Other 1 个文件 · 21 行

需关注文件 · 5

adapters/coze_token_embedded.py Python · 182 行

Embedded obfuscated credentials lack explicit SKILL.md callout

config.json JSON · 32 行

auto_approve_endpoints whitelist is author-preset and pre-loaded

CHANGELOG.md Markdown · 1528 行

http://lb-*.clb.gz-tencentclb.com · https://ct-advisor.coze.site/run · http://127.0.0.1:10808/

scripts/handle_need_tool.py Python · 863 行

http://lb-*.clb.gz-tencentclb.com），实测下载得到非

README.md Markdown · 329 行

[email protected]

其他文件 · refine_answer.py · system_prompt.md · ref-ops-gcp-site.md · refiner.py · ref-reg-submission.md · ref-ops-data.md +1

86 文件 · 1.4 MB · 24023 行

Python 40f · 11361LJSON 11f · 6382LMarkdown 33f · 6259LOther 1f · 21L

├─ ▾ 📁 adapters

│ ├─ 🐍 __init__.py Python 105L · 4.5 KB

│ ├─ 🐍 backend.py Python 90L · 3.6 KB

│ ├─ 🐍 bug_report.py Python 360L · 19.7 KB

│ ├─ 🔑 coze_token_embedded.py ⚠ Python 182L · 9.9 KB

│ ├─ 🐍 data_context.py Python 73L · 2.5 KB

│ ├─ 🐍 http_probe.py Python 36L · 1.6 KB

│ ├─ 🐍 install_sibling.py Python 182L · 8.8 KB

│ ├─ 🐍 probe_publication.py Python 338L · 15.5 KB

│ ├─ 🐍 qa_store.py Python 69L · 2.4 KB

│ ├─ 🐍 refiner.py Python 744L · 41.6 KB

│ └─ 🐍 sanitize.py Python 56L · 2.2 KB

├─ ▾ 📁 assets

│ └─ 📦 icon.svg 2.9 KB

├─ ▾ 📁 knowledge

│ ├─ 📝 methodology_core.md Markdown 216L · 20.4 KB

│ ├─ 📝 prompts.md Markdown 189L · 19.2 KB

│ ├─ 📝 ref-gcp-13-principles.md Markdown 50L · 4.7 KB

│ ├─ 📝 ref-icae-safety.md Markdown 159L · 10.9 KB

│ ├─ 📝 ref-interaction-style.md Markdown 95L · 10.3 KB

│ ├─ 📝 ref-ops-compliance-practical.md Markdown 221L · 9.6 KB

│ ├─ 📝 ref-ops-data.md Markdown 138L · 36.3 KB

│ ├─ 📝 ref-ops-design.md Markdown 106L · 23.6 KB

│ ├─ 📝 ref-ops-execution.md Markdown 126L · 20.6 KB

│ ├─ 📝 ref-ops-gcp-site.md Markdown 167L · 42.2 KB

│ ├─ 📝 ref-ops-safety.md Markdown 96L · 22.0 KB

│ ├─ 📝 ref-reg-cn.md Markdown 125L · 24.8 KB

│ ├─ 📝 ref-reg-gcp-version.md Markdown 25L · 2.0 KB

│ ├─ 📝 ref-reg-safety.md Markdown 64L · 14.3 KB

│ ├─ 📝 ref-reg-stats.md Markdown 72L · 17.0 KB

│ ├─ 📝 ref-reg-submission.md Markdown 165L · 37.2 KB

│ ├─ 📝 ref-regulatory-versions.md Markdown 93L · 7.7 KB

│ ├─ 📝 ref-safety-practical.md Markdown 209L · 7.0 KB

│ ├─ 📝 reference-index.md Markdown 87L · 10.4 KB

│ ├─ 📝 system_prompt.md Markdown 312L · 44.3 KB

│ └─ 📋 term_aliases.json JSON 1149L · 17.9 KB

├─ ▾ 📁 references

│ ├─ 📝 ADVANCED.md Markdown 104L · 9.8 KB

│ ├─ 📋 drug_name_map.json JSON 1482L · 22.8 KB

│ ├─ 📝 search-sites.md Markdown 187L · 9.3 KB

│ ├─ 📝 steps.md Markdown 291L · 27.3 KB

│ ├─ 📋 term_map.json JSON 255L · 8.9 KB

│ ├─ 📝 tier_gate.md Markdown 39L · 10.4 KB

│ ├─ 📝 tone_writing.md Markdown 77L · 4.4 KB

│ ├─ 📝 units.md Markdown 140L · 8.5 KB

│ └─ 📝 visual-appendix.md Markdown 98L · 6.7 KB

├─ ▾ 📁 scripts

│ ├─ 🐍 check_coze.py Python 119L · 5.0 KB

│ ├─ 🐍 check_deps.py Python 216L · 9.9 KB

│ ├─ 🐍 clarify_loop.py Python 437L · 19.8 KB

│ ├─ 🐍 context_stitch.py Python 225L · 9.7 KB

│ ├─ 🐍 drug_name_resolver.py Python 150L · 5.0 KB

│ ├─ 🐍 excel_style.py Python 414L · 23.6 KB

│ ├─ 🐍 gcp_audit.py Python 326L · 10.7 KB

│ ├─ 🐍 generate_term_aliases.py Python 285L · 11.4 KB

│ ├─ 🐍 handle_need_tool.py Python 863L · 42.9 KB

│ ├─ 🐍 hardware_id.py Python 94L · 4.0 KB

│ ├─ 🐍 i18n.py Python 351L · 15.3 KB

│ ├─ 📋 i18n_messages.json JSON 950L · 30.9 KB

│ ├─ 📋 i18n_skill_messages.json JSON 410L · 9.9 KB

│ ├─ 🐍 keyword_breadth.py Python 213L · 9.5 KB

│ ├─ 📋 kw_lexicon.json JSON 1327L · 25.1 KB

│ ├─ 🐍 kw_localize.py Python 827L · 33.4 KB

│ ├─ 🐍 landscape_scorer.py Python 404L · 13.9 KB

│ ├─ 🐍 memory_manager.py Python 265L · 9.9 KB

│ ├─ 📋 menu.json JSON 366L · 8.3 KB

│ ├─ 🐍 menu.py Python 239L · 9.4 KB

│ ├─ 🐍 office_to_md.py Python 217L · 7.4 KB

│ ├─ 🐍 orchestrate.py Python 565L · 28.9 KB

│ ├─ 🐍 r_libs.py Python 129L · 5.3 KB

│ ├─ 🐍 refine_answer.py Python 932L · 53.5 KB

│ ├─ 🐍 route.py Python 346L · 18.0 KB

│ ├─ 🐍 route_tool.py Python 546L · 32.8 KB

│ ├─ 🐍 run_refined.py Python 129L · 4.3 KB

│ ├─ 🐍 search_refs.py Python 140L · 5.7 KB

│ ├─ 🐍 source_guard.py Python 136L · 5.8 KB

│ ├─ 🐍 switch_lang.py Python 60L · 2.1 KB

│ ├─ 🐍 sync_i18n_from_ctbase.py Python 46L · 1.5 KB

│ ├─ 🐍 tone_matcher.py Python 364L · 15.4 KB

│ ├─ 📋 tool_mapping.json JSON 163L · 17.3 KB

│ ├─ 🐍 update_reference_index.py Python 88L · 3.5 KB

│ └─ 📋 workflows.json JSON 243L · 8.5 KB

├─ 📝 AGENTS.md Markdown 102L · 8.8 KB

├─ 📝 CHANGELOG.md Markdown 1528L · 205.2 KB

├─ 📄 LICENSE 21L · 1.1 KB

├─ 📝 README.md Markdown 329L · 37.6 KB

├─ 📝 README_zh-CN.md Markdown 365L · 34.5 KB

├─ 📝 SKILL.md Markdown 216L · 34.2 KB

├─ 📋 _meta.json JSON 5L · 131 B

├─ 🔑 config.json ⚠ JSON 32L · 801 B

└─ 📝 skill-card.md Markdown 68L · 3.3 KB

安全亮点

No reverse shell, C2, or remote code execution beyond the declared Coze cloud API call

Outbound payloads are sanitized: adapters/sanitize.py strips PII (ID cards, phone numbers, emails) and credential-named keys before leaving the local environment

Execution boundary validation in handle_need_tool.py restricts subprocess to python/rscript interpreters and paths inside the skills directory only

No credential-harvesting chain: tokens are shared Coze bot tokens (not personal account keys), and hardware_id produces a non-reversible sha256 hash

Sibling-skill installation is user-gated: default install_mode='suggest' (never auto-install), only executes after explicit user authorization (install_consent=approved)

Bug reports use a hard-whitelist schema (11 fixed keys, no free-form user data), sent only on explicit user request with two-stage confirmation

Comprehensive PII handling documented: SKILL.md explicitly forbids exposing personal info, subject data, unpublished project data, or private paths

Outbound authorization gate (_check_outbound_authorization) runs before every outbound call; non-whitelisted endpoints require user confirmation before data leaves

No base64-into-bash, no eval(), no urllib download-and-execute, no curl|bash patterns

Well-structured, extensively documented codebase (86 files, 24K lines) with clear rationale for every non-obvious design choice