安全决策报告
fork-latte-skill
Hardcoded API key embedded in skill files and undeclared shell auto-heal capability with developer-specific hardcoded paths represent significant hidden behavior not reflected in the declared toolset.
最直接的威胁证据
高危 凭证窃取
Hardcoded API key embedded in skill files API key 'jcc_signup_a7K9mP2xQ8vL4nR6wT1yZ68' is hardcoded in relay-server/config.json (also committed to repo), config.example.json, and SKILL.md as built-in defaults. If relay is exposed beyond localhost, anyone with this key can POST registration data to the target Feishu bitable.
relay-server/config.json:1 为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 10 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 0 步攻击链，另有 2 项高危或严重发现。
复核
依赖与供应链卫生
发现 2 项需要关注的依赖或供应链线索。
风险分是怎么被拉高的
Undeclared shell execution +15
SKILL.md declares bins:["curl"] but uses Start-Process/Invoke-RestMethod PowerShell commands with shell:WRITE semantics
Hardcoded API key exposure +15
API key 'jcc_signup_a7K9mP2xQ8vL4nR6wT1yZ68' is hardcoded in both config.json and SKILL.md defaults; not user-scoped
Developer-specific hardcoded paths +10
Auto-heal logic contains absolute paths to C:\Users\聿\... specific to one developer's machine
No declared permissions for shell access +5
Skill metadata only declares curl bin; no allowed-tools mapping for shell resource
最关键的证据
高危 凭证窃取
Hardcoded API key embedded in skill files
API key 'jcc_signup_a7K9mP2xQ8vL4nR6wT1yZ68' is hardcoded in relay-server/config.json (also committed to repo), config.example.json, and SKILL.md as built-in defaults. If relay is exposed beyond localhost, anyone with this key can POST registration data to the target Feishu bitable.
relay-server/config.json:1 Remove api_key from default configs; require users to set their own. If publishing, do not include any active credentials.
高危 权限提升
Undeclared shell auto-heal with developer-specific hardcoded paths
Step 0.5 of SKILL.md implements auto-heal that silently starts the relay-server via PowerShell Start-Process. The code iterates hardcoded paths including 'C:\Users\聿\.qclaw\skills\fork-latte-skill\relay-server' — a path specific to the developer's Chinese-username Windows machine. This is undeclared, uses shell:WRITE level execution, and the developer-specific path makes it non-functional for other users while revealing internal structure.
SKILL.md:27 Declare shell:WRITE in allowed-tools. Replace hardcoded developer paths with dynamic discovery (e.g., search skill directories or prompt user). Document the auto-heal behavior explicitly.
中危 文档欺骗
Declared bins do not match actual tool dependencies
SKILL.md metadata declares bins:["curl"] but the implementation exclusively uses PowerShell cmdlets (Invoke-RestMethod, Start-Process, Get-NetTCPConnection). macOS/Linux path uses curl, but the primary platform (Windows/OpenClaw) uses PowerShell — neither shell tool is declared in allowed-tools or bins.
SKILL.md:2 Update metadata to declare appropriate allowed-tools: shell:WRITE, network:WRITE. Document PowerShell as a dependency for Windows users.
中危 供应链
relay-server has unversioned dependencies
relay-server/package.json has no dependencies listed but uses Node.js built-ins only (http, fs/promises, child_process). No known vulnerabilities, but the package has no pinned versions for Node itself. server.js spawns lark-cli with shell:true which could be a supply chain risk if lark-cli is compromised.
relay-server/server.js:82 Pin Node.js version requirement. Audit lark-cli binary source. Consider removing shell:true from spawn calls.
低危 敏感访问
relay-server spawns external CLI tool lark-cli
When MODE=lark_cli, server.js spawns 'lark-cli' binary using spawn with shell:true. While this is documented, arbitrary CLI execution on the relay server host is a privilege escalation vector if the relay server is misconfigured.
relay-server/server.js:82 Document that the relay server requires trust in the lark-cli binary. Consider pinning lark-cli version if possible.
声明能力 vs 实际能力
文件系统 通过
声明 READ
→ 推断 READ
SKILL.md: Reads config.json 网络访问 通过
声明 READ
→ 推断 WRITE
SKILL.md: Uses Invoke-RestMethod POST/GET; bins declares curl only 命令执行 阻止
声明 NONE
→ 推断 WRITE
SKILL.md step 0.5: Start-Process to launch relay-server; run-relay.ps1: while loop with Start-Process 可疑产物与外联
中危 外部 URL
https://img.shields.io/gitee/v/tag/qidianjuzhen/agibar-invite-skill?label=version&color=blue&sort=semver README.md:3
中危 外部 URL
https://img.shields.io/badge/api-REST-orange README.md:3
中危 外部 URL
https://img.shields.io/badge/mode-lark__cli%20%7C%20feishu__api-blue README.md:3
中危 外部 URL
https://gitee.com/qidianjuzhen/fork-latte-skill README.md:56
中危 外部 URL
https://img.shields.io/badge/stack-Node.js%20%2B%20Feishu%20Bitable-green relay-server/README.md:3
中危 外部 URL
https://open.feishu.cn relay-server/README.md:28
中危 外部 URL
https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal relay-server/README.md:67
中危 外部 URL
https://open.feishu.cn/open-apis/bitable/v1/apps/ relay-server/README.md:74
中危 外部 URL
https://clawhub.ai/user/moljay skill-card.md:9
中危 外部 URL
https://clawhub.ai/moljay/skills/fork-latte-skill skill-card.md:47
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| node | * | system | 否 | No package.json deps; only Node.js built-ins used (http, fs, child_process) |
| lark-cli | * | external_binary | 否 | Spawned as external binary when MODE=lark_cli; not pinned, shell:true used |
文件构成
10 个文件 · 697 行
Markdown 4 个文件 · 415 行JavaScript 1 个文件 · 239 行Other 1 个文件 · 28 行JSON 4 个文件 · 15 行
需关注文件 · 6
relay-server/config.json Hardcoded API key embedded in skill files
relay-server/server.js relay-server has unversioned dependencies · relay-server spawns external CLI tool lark-cli
SKILL.md Undeclared shell auto-heal with developer-specific hardcoded paths · Declared bins do not match actual tool dependencies
relay-server/README.md https://img.shields.io/badge/stack-Node.js%20%2B%20Feishu%20Bitable-green · https://open.feishu.cn · https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal · https://open.feishu.cn/open-apis/bitable/v1/apps/
README.md https://img.shields.io/gitee/v/tag/qidianjuzhen/agibar-invite-skill?label=version&color=blue&sort=semver · https://img.shields.io/badge/api-REST-orange · https://img.shields.io/badge/mode-lark__cli%20%7C%20feishu__api-blue · https://gitee.com/qidianjuzhen/fork-latte-skill
skill-card.md https://clawhub.ai/user/moljay · https://clawhub.ai/moljay/skills/fork-latte-skill
其他文件 · run-relay.ps1 · package.json · _meta.json · config.example.json
安全亮点
Skill design is legitimate — collecting registration data and writing to Feishu is a valid use case
Credentials (Feishu tokens) are properly contained server-side and never in the client skill
No obfuscation or base64-encoded payloads observed
No credential harvesting from the user's environment (no os.environ iteration, no ~/.ssh access)
No C2 communication or data exfiltration to unexpected endpoints
Error messages are sanitized — internal errors not exposed to users
API_KEY header validation protects against unauthenticated relay access
No malicious attack chain (reverse shell, ransomware, data theft) detected