中文 EN
Start Review
Skill Trust Decision

auto-skill-hunter

技能声称仅需filesystem权限，实际使用network/shell执行未声明操作，包括会话历史读取和外部脚本执行

Install decision first Source: ClawHub Scanned: 19 days ago
Files 6
Artifacts 8
Violations 4
Findings 7
Most direct threat evidence
01
用户部署技能，声称仅需filesystem权限 Entry · claw.json
02
运行时通过 fetchJson 访问 clawhub.com API Escalation · src/hunt.js
03
读取 agents/main/sessions/*.jsonl 收集用户对话上下文 Escalation · src/hunt.js

Why this conclusion was reached

2/4 dimensions flagged
Block
Declared vs actual capability

4 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

8 lower-risk artifacts were extracted and still need context.

Block
Attack chain and severe findings

The report includes 6 attack-chain steps and 3 severe findings.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

Attack Chain

01
用户部署技能，声称仅需filesystem权限

Entry · claw.json:1

02
运行时通过 fetchJson 访问 clawhub.com API

Escalation · src/hunt.js:240

03
读取 agents/main/sessions/*.jsonl 收集用户对话上下文

Escalation · src/hunt.js:118

04
execSync 执行 git clone 安装外部技能

Escalation · src/hunt.js:475

05
spawnSync 执行外部 report.js 脚本

Escalation · src/hunt.js:530

06
外部脚本可能外发收集的会话数据和技能推荐信息

Impact · ../../feishu-evolver-wrapper/report.js:1

What drove the risk score up

未声明的网络请求 +15

fetchJson 访问 clawhub.com API，SKILL.md 未声明

未声明的shell执行 +15

execSync git clone 和 node --self-test，SKILL.md 未声明

会话历史读取 +10

读取 SESSIONS_DIR/*.jsonl 暴露用户对话上下文

外部报告脚本执行 +10

sendHunterReport 调用 ../../feishu-evolver-wrapper/report.js，行为未知

代码生成能力 +5

ensureRunnableShim 动态生成 index.js 和 SKILL.md

Most important evidence

High Doc Mismatch

文档未声明网络请求能力

fetchJson 函数访问 clawhub.com API 端点，但 SKILL.md 和 claw.json 均未声明 network 权限

src/hunt.js:240
在 SKILL.md 和 claw.json 中补充声明 network 权限
High Doc Mismatch

文档未声明Shell执行能力

installSkill 函数通过 execSync 执行 git clone 和 node --self-test，SKILL.md 未声明 shell 权限

src/hunt.js:475
在 SKILL.md 补充说明 live install 模式会执行 git clone
High Sensitive Access

未声明的会话历史读取

collectRecentUserMessages 读取 agents/main/sessions/*.jsonl，暴露用户近期对话内容

src/hunt.js:118
在文档中明确声明并说明仅用于问题挖掘
Medium RCE

外部脚本执行能力

sendHunterReport 通过 spawnSync 执行 ../../feishu-evolver-wrapper/report.js，该脚本行为未知且可能外发数据

src/hunt.js:530
审查 report.js 源码，禁用时应使用 SKILL_HUNTER_NO_REPORT=1
Medium Supply Chain

git clone 无版本锁定

installSkill 直接克隆 repoUrl，无 commit/tag 锁定，可能引入恶意版本

src/hunt.js:476
要求使用 --branch 指定版本或 hash 锁定
Medium Priv Escalation

动态代码生成与执行

ensureRunnableShim 在安装目录生成 index.js 和 SKILL.md，可植入任意代码

src/hunt.js:355
审查生成的代码内容，考虑签名验证
Low Sensitive Access

用户画像和人格状态读取

extractAgentProfileKeywords 和 getPersonalityProfile 读取 USER.md 和 personality_state.json

src/hunt.js:206
确认这些数据用于技能推荐是否必要

Declared capability vs actual capability

Filesystem Pass
Declared WRITE
→
Inferred WRITE
src/hunt.js:4-14 读取/写入工作区文件
Network Block
Declared NONE
→
Inferred READ
src/hunt.js:240-255 fetchJson 访问 clawhub.com API
Shell Block
Declared NONE
→
Inferred WRITE
src/hunt.js:475-477 execSync git clone
Environment Block
Declared NONE
→
Inferred READ
src/hunt.js:62-65 读取 SKILL_HUNTER_* 环境变量
Skill Invoke Block
Declared NONE
→
Inferred WRITE
src/hunt.js:430-450 安装外部技能到 SKILLS_DIR

Suspicious artifacts and egress

Medium External URL
https://clawhub.ai/wanng-ide/memory-mesh-core

README.md:7

Medium External URL
https://clawhub.ai/user/terrycarter1985

skill-card.md:9

Medium External URL
https://clawhub.ai/terrycarter1985/skills/wanng-ide-auto-skill-hunter

skill-card.md:39

Medium External URL
https://clawhub.com/api/v1/skills/trending?limit=30

src/hunt.js:16

Medium External URL
https://clawhub.com/api/v1/skills?sort=trending&limit=30

src/hunt.js:17

Medium External URL
https://clawhub.com/api/v1/skills?limit=30

src/hunt.js:18

Medium External URL
https://clawhub.com/api/v1/skills/search?q=

src/hunt.js:22

Medium External URL
https://clawhub.com/api/v1/skills?q=

src/hunt.js:23

Dependencies and supply chain

There are no structured dependency warnings.

File composition

6 files · 1149 lines
JavaScript 1 files · 828 linesMarkdown 3 files · 304 linesJSON 2 files · 17 lines
Files of concern · 3
src/hunt.js JavaScript · 828 lines
文档未声明网络请求能力 · 文档未声明Shell执行能力 · 未声明的会话历史读取 · 外部脚本执行能力 · git clone 无版本锁定 · 动态代码生成与执行 · 用户画像和人格状态读取 · https://clawhub.com/api/v1/skills/trending?limit=30 · https://clawhub.com/api/v1/skills?sort=trending&limit=30 · https://clawhub.com/api/v1/skills?limit=30 · https://clawhub.com/api/v1/skills/search?q= · https://clawhub.com/api/v1/skills?q=
README.md Markdown · 134 lines
https://clawhub.ai/wanng-ide/memory-mesh-core
skill-card.md Markdown · 58 lines
https://clawhub.ai/user/terrycarter1985 · https://clawhub.ai/terrycarter1985/skills/wanng-ide-auto-skill-hunter
Other files · SKILL.md · claw.json · _meta.json

Security positives

提供 --dry-run 模式避免实际安装
提供 --max-install 限制安装数量
有 SKILL_HUNTER_NO_REPORT=1 禁用报告外发
validateRunnableSkill 进行自检验证
不覆盖已存在的技能目录