Skill Trust Decision
tokst-memory
文档型技能，通过curl|bash管道安装远程CLI工具，存在供应链风险但无直接恶意代码
Most direct threat evidence
01
AI Agent读取SKILL.md，被指导使用curl|bash安装TokST CLI Entry · SKILL.md
02
Agent执行curl -fsSL https://tokst.com/install.sh | bash Escalation · README.md
03
如果tokst.com被攻陷或MITM攻击，攻击者可在受害者机器执行任意代码 Impact · 外部服务器
Why this conclusion was reached
2/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 3 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
AI Agent读取SKILL.md，被指导使用curl|bash安装TokST CLI
Entry · SKILL.md:48
02
Agent执行curl -fsSL https://tokst.com/install.sh | bash
Escalation · README.md:20
03
如果tokst.com被攻陷或MITM攻击，攻击者可在受害者机器执行任意代码
Impact · 外部服务器
What drove the risk score up
curl|bash远程脚本执行 +30
README.md:20和SKILL.md:48包含curl -fsSL https://tokst.com/install.sh | bash，攻击者可篡改远程脚本
无本地代码可审计 +15
该skill仅包含Markdown文档，实际逻辑在远程CLI中，完全黑盒无法验证
PowerShell远程脚本执行 +5
SKILL.md:53包含irm https://tokst.com/install.ps1 | iex
外部云服务依赖 +5
所有操作连接api.tokst.com，数据外传至第三方
Most important evidence
High Supply Chain
curl|bash管道执行远程脚本
SKILL.md和README.md包含curl -fsSL https://tokst.com/install.sh | bash命令，通过管道将远程脚本直接执行。这是已知的RCE风险模式，攻击者可篡改tokst.com上的install.sh实施供应链攻击。
README.md:20 使用本地下载安装包（如.deb、.pkg）或官方包管理器安装，避免管道执行远程脚本
High Supply Chain
PowerShell远程脚本执行
Windows安装使用irm https://tokst.com/install.ps1 | iex，同样是管道执行远程脚本的高危模式。
SKILL.md:53 下载.ps1脚本后检查内容，再执行或使用签名脚本
Medium Sensitive Access
记忆系统可能收集敏感上下文
该skill被设计用于持久化记忆，可能存储用户项目中的敏感信息（架构、决策、凭证上下文）。SKILL.md明确要求不存储secrets，但实际取决于用户操作。
SKILL.md:135 用户应定期审查已存储的记忆内容，避免在记忆中包含敏感信息
Medium Doc Mismatch
无本地代码可审计
该skill仅包含Markdown文档，核心逻辑在远程CLI工具中。无法验证install.sh、tokst二进制、MCP服务是否包含恶意代码。
SKILL.md:1 在安全环境中先下载并检查install.sh内容；检查CLI哈希值；考虑fork或使用本地替代方案
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred READ
SKILL.md:91 tokst local remember Network Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:48 curl|bash安装外部CLI Shell Pass
Declared WRITE
→ Inferred WRITE
README.md:20管道执行远程安装脚本 Environment Pass
Declared READ
→ Inferred READ
SKILL.md:126 TOKST_AGENT=1环境变量 Suspicious artifacts and egress
Critical Dangerous Command
curl -fsSL https://tokst.com/install.sh | bash README.md:20
Medium External URL
https://tokst.com/install.sh README.md:20
Medium External URL
https://tokst.com/install.ps1 README.md:26
Medium External URL
https://tokst.com/docs README.md:54
Medium External URL
https://tokst.com/help README.md:56
Medium External URL
https://tokst.com/llms.txt SKILL.md:38
Medium External URL
https://tokst.com/llms-full.txt SKILL.md:39
Medium External URL
https://api.tokst.com/openapi.json SKILL.md:40
Medium External URL
https://api.tokst.com/.well-known/mcp SKILL.md:41
Medium External URL
https://tokst.com/docs/tasks SKILL.md:216
Medium External URL
https://api.tokst.com/mcp SKILL.md:258
Medium External URL
https://tokst.com/docs/mcp SKILL.md:386
Dependencies and supply chain
There are no structured dependency warnings.
File composition
7 files · 723 lines
Markdown 6 files · 718 linesJSON 1 files · 5 lines
Files of concern · 3
SKILL.md PowerShell远程脚本执行 · 记忆系统可能收集敏感上下文 · 无本地代码可审计 · https://tokst.com/llms.txt · https://tokst.com/llms-full.txt · https://api.tokst.com/openapi.json · https://api.tokst.com/.well-known/mcp · https://tokst.com/docs/tasks · https://api.tokst.com/mcp · https://tokst.com/docs/mcp · https://tokst.com/docs/sessions · https://tokst.com/docs/local
skill-card.md https://clawhub.ai/user/anthemty
README.md curl|bash管道执行远程脚本 · curl -fsSL https://tokst.com/install.sh | bash · https://tokst.com/install.sh · https://tokst.com/install.ps1 · https://tokst.com/docs · https://tokst.com/help
Other files · CODEX.md · CLAUDE.md · GENERAL.md · _meta.json
Security positives
skill-card.md提供了详细的风险提示和缓解措施
SKILL.md明确警告不存储secrets和credentials
支持本地模式(tokst setup --local)减少外部依赖
声称MIT许可证，有公开文档
无内嵌恶意代码（文档型skill）