安全决策报告
introspection-debugger
Skill implements legitimate debugging functionality but contains multiple undeclared sensitive capabilities: arbitrary shell execution, filesystem write at extracted paths, and external network transmission of full error reports including stack traces.
最直接的威胁证据
01
Skill presented as debugging framework in SKILL.md 初始入口 · SKILL.md
02
Hides shell execution capability from documentation stealth · SKILL.md
03
Executes arbitrary shell commands via execAsync 权限提升 · introspection-debugger.js
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 2 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 5 步攻击链，另有 2 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
攻击链
01
Skill presented as debugging framework in SKILL.md
初始入口 · SKILL.md:1
02
Hides shell execution capability from documentation
stealth · SKILL.md:1
03
Executes arbitrary shell commands via execAsync
权限提升 · introspection-debugger.js:225
04
Writes files to arbitrary paths extracted from errors
权限提升 · introspection-debugger.js:137
05
Exfiltrates full error reports with stack traces to external webhook
最终危害 · introspection-debugger.js:263
风险分是怎么被拉高的
Undeclared shell execution +20
execAsync runs arbitrary shell commands (npm install, chmod) not mentioned in SKILL.md
Undeclared filesystem WRITE +15
Creates files at paths extracted from error messages without declaring this capability
Undeclared network exfiltration +15
Sends full error reports with stack traces to arbitrary webhook URLs
Arbitrary dependency installation +10
npm install without version pinning - supply chain risk
Documentation mismatch +10
SKILL.md does not mention shell commands, file writes to extracted paths, or webhook POST requests
最关键的证据
高危 文档欺骗
Undeclared shell command execution
The skill executes arbitrary shell commands via exec() function (npm install, chmod +x) but SKILL.md does not declare any shell execution capabilities. This violates transparency requirements.
introspection-debugger.js:225 Document shell execution as a declared capability with clear use cases in SKILL.md
高危 文档欺骗
Undeclared network transmission
The notificationHook can POST full error reports including stack traces to arbitrary external URLs. This is data exfiltration capability not declared in SKILL.md.
introspection-debugger.js:263 Document network transmission capability and advise users to only use trusted internal webhooks
中危 权限提升
Unrestricted file creation at extracted paths
The createMissingFile fix method extracts file paths from error messages and writes files to those paths. This could be exploited to write files to arbitrary locations if error messages are crafted.
introspection-debugger.js:137 Implement path validation to restrict file writes to workspace directory only
中危 供应链
Dependency installation without version pinning
The installDependency method runs 'npm install <moduleName>' without specifying versions, allowing installation of latest versions which could introduce malicious dependencies.
introspection-debugger.js:159 Pin to major version ranges or require explicit user approval for installation
中危 数据外泄
Full error context including stack traces transmitted externally
Error reports sent via notificationHook include full stack traces which may contain sensitive information like file paths, environment context, or internal logic.
introspection-debugger.js:293 Redact or allow users to configure which fields are included in external reports
声明能力 vs 实际能力
文件系统 阻止
声明 NONE
→ 推断 WRITE
introspection-debugger.js:137 fs.writeFileSync(filePath, content) 命令执行 阻止
声明 NONE
→ 推断 WRITE
introspection-debugger.js:225 execAsync(cmd, options) 网络访问 阻止
声明 NONE
→ 推断 WRITE
introspection-debugger.js:263 fetch.request with POST method to notificationHook 环境变量 通过
声明 NONE
→ 推断 NONE
— 可疑产物与外联
中危 外部 URL
https://clawhub.ai/user/danihe001 skill-card.md:7
中危 外部 URL
https://clawhub.ai/danihe001/introspection-debugger skill-card.md:27
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| Node.js built-ins | N/A | builtin | 否 | Uses only built-in modules: fs, path, child_process, events |
文件构成
4 个文件 · 660 行
JavaScript 1 个文件 · 526 行Markdown 2 个文件 · 129 行JSON 1 个文件 · 5 行
需关注文件 · 2
introspection-debugger.js Undeclared shell command execution · Undeclared network transmission · Unrestricted file creation at extracted paths · Dependency installation without version pinning · Full error context including stack traces transmitted externally
skill-card.md https://clawhub.ai/user/danihe001 · https://clawhub.ai/danihe001/introspection-debugger
其他文件 · SKILL.md · _meta.json
安全亮点
No credential harvesting detected (does not iterate os.environ for secrets)
No base64 obfuscation or anti-analysis techniques found
No access to sensitive paths like ~/.ssh, ~/.aws, or .env
No reverse shell, C2 communication, or persistence mechanisms
Legitimate use case for AI agent self-diagnosis and repair