安全决策报告
wenzi-runse
Hardcoded API key embedded in source and undeclared Tencent Cloud network endpoints constitute significant hidden behavior not reflected in documentation, with plaintext local credential storage as an additional concern.
最直接的威胁证据
高危 凭证窃取
Hardcoded API key in distributed skill package A full OpenAI-format API key (sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7) is hardcoded as DEFAULT_API_KEY in scripts/runse.py line 21. This key is packaged and distributed with the skill, making it trivially extractable by anyone who installs the skill. The key's purpose and ownership are unclear — it is not the user's key but a shared/developer key embedded in the delivery artifact.
scripts/runse.py:21 为什么得出这个结论
2/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
阻止
隐藏执行与外联
提取到 2 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 0 步攻击链，另有 1 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
风险分是怎么被拉高的
Hardcoded API key in source +15
scripts/runse.py:21 contains sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7 hardcoded as DEFAULT_API_KEY — a credential distributed with the skill package
Undeclared external network endpoints +15
SKILL.md declares Bash but does not mention the two Tencent Cloud Function URLs (ap-shanghai.tencentscf.com); skill-card.md vaguely mentions 'cloud service' but omits the specific infrastructure endpoint
Doc-code mismatch on data flow +10
SKILL.md describes '无状态运行，不存储原文' but the implementation writes user text to a temp file (./tmp_input.txt) before sending — this file I/O is not declared
最关键的证据
高危 凭证窃取
Hardcoded API key in distributed skill package
A full OpenAI-format API key (sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7) is hardcoded as DEFAULT_API_KEY in scripts/runse.py line 21. This key is packaged and distributed with the skill, making it trivially extractable by anyone who installs the skill. The key's purpose and ownership are unclear — it is not the user's key but a shared/developer key embedded in the delivery artifact.
scripts/runse.py:21 Remove the hardcoded key from source code. Use environment variable OPENAI_API_KEY or prompt the user at runtime. If a shared public key is necessary for free tier, retrieve it from a secure, rotation-capable endpoint rather than embedding it in the script.
中危 文档欺骗
Undeclared external network endpoints
SKILL.md and skill-card.md describe the skill as calling a 'cloud function' but do not name the specific infrastructure. The actual implementation makes HTTP requests to https://1257707270-955niawhww.ap-shanghai.tencentscf.com/bailian/chat and https://1257707270-955niawhww.ap-shanghai.tencentscf.com/v1/models — Tencent Cloud Function endpoints — neither of which is mentioned in any documentation. Users cannot audit which external service their text is sent to.
scripts/runse.py:19 Document the specific cloud service provider, endpoint URLs, and data flows in SKILL.md under a clearly labeled 'Network Access' or 'Third-Party Services' section.
中危 文档欺骗
Undeclared temporary file I/O
SKILL.md instructs to write text to a temporary file (./tmp_input.txt) before processing but does not declare filesystem WRITE access as part of the skill's capabilities. The file write/read cycle is used for the main processing flow but is not mentioned in the allowed-tools mapping or capability description.
scripts/runse.py:163 Ensure filesystem WRITE is explicitly declared and documented as part of the normal processing workflow when temporary files are involved.
低危 凭证窃取
Plaintext local credential storage without encryption
User-provided personal API keys are saved in plaintext JSON format (0o600 file mode) to a user-specified or default path (~/.workbuddy/wenzi-runse-config.json). While the skill-card.md mentions this, SKILL.md frames it as an optional '进阶' feature and does not prominently warn about plaintext storage risks.
scripts/runse.py:62 Add a prominent security warning about plaintext credential storage. Consider using the system keyring (keyring module) instead of JSON files for storing API keys.
声明能力 vs 实际能力
文件系统 通过
声明 WRITE
→ 推断 WRITE
SKILL.md declares Write; runse.py writes temp files at line 163 网络访问 通过
声明 WRITE
→ 推断 WRITE
Bash declared in allowed-tools; HTTP POST to tencentscf.com implicit via script invocation 命令执行 通过
声明 WRITE
→ 推断 WRITE
SKILL.md declares Bash; runse.py executed as subprocess 环境变量 通过
声明 NONE
→ 推断 READ
runse.py reads os.environ via sys.stdout.encoding check; documented key storage path includes ~ expansion 可疑产物与外联
严重 API 密钥
sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7 scripts/runse.py:21
高危 API 密钥
API_KEY = "sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7" scripts/runse.py:21
中危 外部 URL
https://1257707270-955niawhww.ap-shanghai.tencentscf.com/bailian/chat scripts/runse.py:19
中危 外部 URL
https://1257707270-955niawhww.ap-shanghai.tencentscf.com/v1/models scripts/runse.py:20
中危 外部 URL
https://clawhub.ai/user/abcqq1234567 skill-card.md:9
中危 外部 URL
https://clawhub.ai/abcqq1234567/skills/wenzi-runse skill-card.md:39
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| urllib | stdlib | Python standard library | 否 | Used for HTTP requests — stdlib, no external dependency |
| json | stdlib | Python standard library | 否 | Stdlib JSON serialization |
| os | stdlib | Python standard library | 否 | Stdlib file system operations |
| argparse | stdlib | Python standard library | 否 | Stdlib CLI argument parsing |
文件构成
5 个文件 · 454 行
Markdown 3 个文件 · 260 行Python 1 个文件 · 189 行JSON 1 个文件 · 5 行
需关注文件 · 2
scripts/runse.py Hardcoded API key in distributed skill package · Undeclared external network endpoints · Undeclared temporary file I/O · Plaintext local credential storage without encryption · sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7 · API_KEY = "sk-16a611a2dbb9270b476c2caf29414e345f587f0548aca4a7" · https://1257707270-955niawhww.ap-shanghai.tencentscf.com/bailian/chat · https://1257707270-955niawhww.ap-shanghai.tencentscf.com/v1/models
skill-card.md https://clawhub.ai/user/abcqq1234567 · https://clawhub.ai/abcqq1234567/skills/wenzi-runse
其他文件 · SKILL.md · README.md · _meta.json
安全亮点
No obfuscation techniques detected — no base64, eval(), or dynamic code generation
No attempts to access ~/.ssh, ~/.aws, .env, or other sensitive credential paths outside the declared config
No reverse shell, C2 communication, or data exfiltration patterns observed
Input text length validation (≥300 chars) prevents abuse via tiny payloads
API key format validation (must start with 'sk-') before saving
File permissions set to 0o600 on credential storage file where supported
User confirmation required before saving personal API key to disk (not auto-saved)
Skill-card.md correctly discloses cloud service usage and plaintext credential storage risks under 'Known Risks and Mitigations'
All Python dependencies (urllib, json, os, sys, argparse) are stdlib — no third-party supply chain risk