安全决策报告
pub
The pub skill exhibits multiple dangerous supply chain patterns: unverified remote script execution (curl|bash from pub.blue), self-update capability without integrity verification, and a persistent daemon that bridges to external agent runtimes—all combining to create a plausible supply chain attack surface.
最直接的威胁证据
01
User installs pub CLI via documented curl|bash from pub.blue delivery · SKILL.md
02
install.sh script executes, downloading binary from pub.blue (no hash verification) delivery · https://pub.blue/install.sh
03
User configures PUB_API_KEY for authentication 持久化 · SKILL.md
为什么得出这个结论
2/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 6 步攻击链，另有 3 项高危或严重发现。
复核
依赖与供应链卫生
发现 1 项需要关注的依赖或供应链线索。
攻击链
01
User installs pub CLI via documented curl|bash from pub.blue
delivery · SKILL.md:40
02
install.sh script executes, downloading binary from pub.blue (no hash verification)
delivery · https://pub.blue/install.sh
03
User configures PUB_API_KEY for authentication
持久化 · SKILL.md:47
04
pub start launches persistent daemon bridging to external agent runtimes
命令与控制 · SKILL.md:73
05
pub upgrade command replaces binary with attacker-controlled version
权限提升 · SKILL.md:45
06
Compromised binary can access PUB_API_KEY, read/write published content, and bridge to agent runtime for command injection
最终危害 · SKILL.md:47
风险分是怎么被拉高的
Unverified remote script execution +25
SKILL.md:40 documents curl -fsSL https://pub.blue/install.sh | bash, pulling from a single non-GitHub domain with no hash verification or version pinning
Self-updating binary without integrity checks +20
SKILL.md documents 'pub upgrade' command; self-update capability combined with non-verified install source enables supply chain pivots
Persistent daemon bridging to external agent runtimes +15
pub start launches a background daemon bridging to claude-code, claude-sdk, openclaw runtimes with no clear security boundaries
Broad shell permissions +10
allowed-tools: Bash(pub:*) and Bash(node:*) — wildcard permissions on pub and node commands not scoped to specific operations
最关键的证据
高危 供应链
Remote script execution from unverified source
SKILL.md explicitly documents 'curl -fsSL https://pub.blue/install.sh | bash' as an installation method. This pulls executable code from a single domain without version pinning, hash verification, or HTTPS certificate pinning. While GitHub releases are mentioned as an alternative, the preferred install path is the unverified script.
SKILL.md:40 Remove the install.sh reference. Only document installation from verified GitHub releases with pinned version and binary hash verification.
高危 供应链
Self-update capability without integrity verification
The 'pub upgrade' command allows the binary to update itself. Combined with the non-verified install source, a compromised pub.blue domain or man-in-the-middle attack could deliver a modified binary during upgrade.
SKILL.md:45 Document that pub upgrade should verify GPG signatures or SHA256 hashes before applying updates.
高危 代码执行
Persistent daemon with agent runtime bridge
'pub start --agent-name' launches a background daemon that bridges to external agent runtimes (claude-code, claude-sdk, claude-channel, openclaw-like). This creates a persistent reverse-communication channel and enables command dispatch from the pub.blue infrastructure to the local agent.
SKILL.md:73 Document the bridge architecture and data flows. Explicitly warn that pub.blue infrastructure can communicate with the local agent through this channel.
中危 权限提升
Broad shell command permissions
allowed-tools declares Bash(pub:*) and Bash(node:*) — wildcard permissions grant unrestricted access to all pub subcommands and node binaries, including 'pub upgrade', 'pub delete', and any node commands on the system.
SKILL.md:4 Scope Bash permissions to specific required subcommands: Bash(pub:create,pub:get,pub:update,pub:list,pub:write) only.
中危 文档欺骗
Network resource access not declared
The skill inherently requires full network access to pub.blue API and CDN resources but declares no network permissions. This obscures the data exfiltration and C2 surface.
SKILL.md:1 Declare network:READ or network:WRITE in allowed-tools to reflect actual API communication.
中危 敏感访问
API key handling with minimal scoping guidance
The skill requires PUB_API_KEY for authentication but provides no guidance on key scoping, rotation, or audit. The 'pub config --api-key-stdin' pattern also risks key exposure in shell history.
SKILL.md:47 Recommend environment variable injection rather than stdin echo for API key configuration.
声明能力 vs 实际能力
文件系统 通过
声明 READ, WRITE
→ 推断 READ, WRITE
SKILL.md allowed-tools: Read Write 命令执行 通过
声明 WRITE
→ 推断 WRITE
SKILL.md allowed-tools: Bash(pub:*) Bash(node:*) 网络访问 通过
声明 NONE (implied)
→ 推断 READ, WRITE
Inherently required for pub.blue API communication; not declared but unavoidable 环境变量 通过
声明 NONE
→ 推断 READ (API key)
pub config --api-key reads PUB_API_KEY; skill-card.md acknowledges API key requirement 可疑产物与外联
严重 危险命令
curl -fsSL https://pub.blue/install.sh | bash SKILL.md:40
中危 外部 URL
https://pub.blue SKILL.md:6
中危 外部 URL
https://pub.blue/install.sh SKILL.md:40
中危 外部 URL
https://pub.blue/agents SKILL.md:54
中危 外部 URL
https://clawhub.ai/user/xmanatee skill-card.md:7
中危 外部 URL
https://clawhub.ai/xmanatee/pub skill-card.md:32
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| pub CLI binary | 5.2.17 (floating) | pub.blue/install.sh or github.com/xmanatee/pub/releases | 否 | No version pinning, no binary hash verification documented. install.sh source is non-GitHub and unauthenticated. |
文件构成
4 个文件 · 233 行
Markdown 2 个文件 · 217 行JSON 2 个文件 · 16 行
需关注文件 · 2
SKILL.md Remote script execution from unverified source · Self-update capability without integrity verification · Persistent daemon with agent runtime bridge · Broad shell command permissions · Network resource access not declared · API key handling with minimal scoping guidance · curl -fsSL https://pub.blue/install.sh | bash · https://pub.blue · https://pub.blue/install.sh · https://pub.blue/agents
skill-card.md https://clawhub.ai/user/xmanatee · https://clawhub.ai/xmanatee/pub
其他文件 · claw.json · _meta.json
安全亮点
Open source with MIT license and verifiable GitHub repository
Content publishing commands are straightforward and documented
Pubs are private by default
SKILL.md documents the remote install pattern explicitly (no hidden functionality)
No base64, eval, or obfuscated code patterns found in documentation