Skill Trust Decision
pub
install.sh 远程安装命令超出 allowed-tools 声明范围，但为合法 CLI 工具安装场景，无阴影行为
Most direct threat evidence
High Priv Escalation
shell 命令超出 allowed-tools 声明范围 allowed-tools 声明 Bash(pub:*) 和 Bash(node:*)，仅覆盖 pub CLI 和 node 调用。但 curl | bash 是任意 shell 执行，属于 shell:WRITE 级别的全命令执行权限，超出声明范围。
SKILL.md:40 Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
shell 命令超出 allowed-tools 声明范围 +25
声明 Bash(pub:*) Bash(node:*) Read Write，但执行 curl | bash 属于 filesystem:WRITE + shell:WRITE 级别的任意命令执行，未被声明
远程脚本无校验执行 +15
curl -fsSL https://pub.blue/install.sh | bash — 无 SHA256 校验、无版本锁定，攻击者可劫持 DNS 将安装替换为恶意脚本
安装命令位于文档注释中而非纯文档 +5
install.sh 在注释示例中但被预扫描标记为 CRITICAL IOC，混淆了文档与可执行操作的边界
Most important evidence
High Priv Escalation
shell 命令超出 allowed-tools 声明范围
allowed-tools 声明 Bash(pub:*) 和 Bash(node:*)，仅覆盖 pub CLI 和 node 调用。但 curl | bash 是任意 shell 执行，属于 shell:WRITE 级别的全命令执行权限，超出声明范围。
SKILL.md:40 将 allowed-tools 改为 Bash(*) 或移除 install.sh 用预编译二进制说明替代
Medium Supply Chain
远程安装脚本无完整性校验
install.sh 通过管道传递给 bash 执行，无 SHA256 校验、无版本锁定。攻击者可对 pub.blue 域实施 DNS 劫持或供应链投毒，将安装脚本替换为恶意内容。
SKILL.md:40 使用预编译二进制 + SHA256 校验，或要求用户预先安装 pub CLI
Low Doc Mismatch
CDN 资源引用产生隐式网络访问
SKILL.md 引用 cdn.jsdelivr.net 加载 daisyUI 和 Tailwind CSS，浏览器实际访问时会产生对外部 CDN 的网络请求，但该网络行为未在 allowed-tools 中声明。
SKILL.md:76 明确说明运行时需要网络访问以加载 UI 组件 CDN，或将依赖打包到本地
Declared capability vs actual capability
Shell Block
Declared WRITE (Bash:pub:*)
→ Inferred WRITE (Bash:*)
SKILL.md:40 — curl -fsSL https://pub.blue/install.sh | bash 属于任意 shell 执行，非仅 pub CLI 调用 Filesystem Pass
Declared WRITE (Write)
→ Inferred WRITE
SKILL.md:60 — pub write -c canvas 用于写入 HTML 文件 Network Pass
Declared NONE (未声明)
→ Inferred READ (隐式)
SKILL.md:37,76 — 引用 cdn.jsdelivr.net 和 pub.blue URL，产生隐式网络访问；CDN 资源加载属于未声明行为 Environment Pass
Declared READ (PUB_API_KEY)
→ Inferred READ
claw.json & SKILL.md:44 — PUB_API_KEY 声明为必需环境变量 Suspicious artifacts and egress
Critical Dangerous Command
curl -fsSL https://pub.blue/install.sh | bash SKILL.md:40
Medium External URL
https://pub.blue SKILL.md:6
Medium External URL
https://pub.blue/install.sh SKILL.md:40
Medium External URL
https://pub.blue/agents SKILL.md:54
Dependencies and supply chain
There are no structured dependency warnings.
File composition
2 files · 179 lines
Markdown 1 files · 168 linesJSON 1 files · 11 lines
Files of concern · 1
SKILL.md shell 命令超出 allowed-tools 声明范围 · 远程安装脚本无完整性校验 · CDN 资源引用产生隐式网络访问 · curl -fsSL https://pub.blue/install.sh | bash · https://pub.blue · https://pub.blue/install.sh · https://pub.blue/agents
Other files · claw.json
Security positives
纯文档型 skill，无实际脚本文件，排除代码层阴影行为
PUB_API_KEY 环境变量在文档中明确声明
使用 HTTPS URL，无裸 IP 或加密隧道
无 base64/eval/环境变量遍历收割等高危模式
无凭证外传、无数据外泄行为
MIT license，代码仓库可审计 (github.com/xmanatee/pub)