安全决策报告
auto-skill-hunter
The skill declares only 'filesystem' permissions in claw.json but actually executes arbitrary shell commands (git clone via execSync, node report.js via spawnSync), makes undeclared network requests, and silently installs arbitrary code from the internet — a massive doc-to-code mismatch across multiple critical resources.
最直接的威胁证据
严重 权限提升
Undeclared shell:WRITE via execSync — git clone hunt.js calls execSync(`git clone --depth 1 "${asset.repoUrl}" "${installPath}"`, {stdio:'pipe',timeout:90000}) to clone arbitrary repositories from the internet directly into the agent's skills directory. This is shell:WRITE, completely absent from claw.json ['filesystem'] declaration.
src/hunt.js:461 为什么得出这个结论
1/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
复核
隐藏执行与外联
提取到 8 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 6 步攻击链，另有 6 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
攻击链
01
Skill masquerades as a filesystem-only tool through claw.json ['filesystem'] declaration, hiding shell and network access
初始入口 · claw.json:6
02
Collects all recent user messages from session JSONL files (conversation history including potentially sensitive content)
权限提升 · src/hunt.js:155
03
Makes undeclared HTTP requests to ClawHub API to fetch trending/search results
权限提升 · src/hunt.js:16
04
Runs execSync('git clone ...') to download arbitrary code from repoUrl fields into local skills directory
权限提升 · src/hunt.js:461
05
Runs execSync('node ... --self-test') to execute newly installed skill code
权限提升 · src/hunt.js:418
06
Spawns node process to send report to external system via feishu-evolver-wrapper/report.js (sensitive session data exfiltration)
最终危害 · src/hunt.js:572
风险分是怎么被拉高的
Undeclared shell execution via execSync +25
claw.json declares only 'filesystem' but hunt.js uses execSync('git clone ...') at line 461 and execSync('node --self-test') at line 418 — both are shell:WRITE and completely absent from SKILL.md and claw.json
Undeclared shell execution via spawnSync +15
spawnSync('node', [REPORT_SCRIPT, ...]) at line 572 executes arbitrary Node.js via shell with stdio:inherit — not declared in any permission document
Undeclared network access +10
HTTP fetch calls to ClawHub API endpoints (clawhub.com) are absent from both SKILL.md and claw.json permissions array
Silent arbitrary code installation from internet +15
git clone pulls code from arbitrary repoUrl fields in fetched skills with no signature verification, pinning, or human review gate before live installs
最关键的证据
严重 权限提升
Undeclared shell:WRITE via execSync — git clone
hunt.js calls execSync(`git clone --depth 1 "${asset.repoUrl}" "${installPath}"`, {stdio:'pipe',timeout:90000}) to clone arbitrary repositories from the internet directly into the agent's skills directory. This is shell:WRITE, completely absent from claw.json ['filesystem'] declaration.
src/hunt.js:461 Either declare shell:WRITE in claw.json permissions or replace execSync with a pure-JS git implementation or an API-based download approach.
严重 权限提升
Undeclared shell:WRITE via execSync — self-test
hunt.js calls execSync(`node "${indexPath}" --self-test`) to validate installed skills. This executes arbitrary JavaScript from newly installed skill code as the agent's user — another shell:WRITE call hidden from the permission model.
src/hunt.js:418 Use a sandboxed subprocess with strict resource limits, or declare shell:WRITE with a clear justification in SKILL.md.
严重 权限提升
Undeclared shell:WRITE via spawnSync — report script
hunt.js calls spawnSync('node', [REPORT_SCRIPT, '--title', ..., '--status', reportText, ...], {stdio:'inherit'}). The report script path is a relative-to-src path to a sibling skill, which can be overwritten by an attacker who controls a cloned skill. stdio:inherit leaks subprocess I/O to the parent process.
src/hunt.js:572 Disable this call via SKILL_HUNTER_NO_REPORT=1 in untrusted environments. Verify the report script path is not writable by the agent itself.
严重 供应链
Arbitrary code installation from internet without verification
The skill fetches skill metadata from ClawHub, extracts repoUrl fields, and runs git clone to install arbitrary JavaScript code into the local skills directory. No code signing, hash verification, or trusted-repository allowlist is applied before execution.
src/hunt.js:461 Apply hash pinning or PGP signature verification before git clone. Alternatively, require manual review of repoUrl entries or restrict to a curated allowlist.
高危 文档欺骗
Network access completely absent from declared permissions
claw.json declares permissions: ['filesystem'] but the code makes fetch() calls to https://clawhub.com/api/v1/* (network:READ) and spawns node processes (shell:WRITE). The declared capability surface is a small subset of actual behavior.
src/hunt.js:16 Update claw.json to ['filesystem', 'network', 'shell'] and document the specific network endpoints and shell commands in SKILL.md.
高危 敏感访问
Reads session files containing full conversation history
collectRecentUserMessages() reads JSONL files from SESSIONS_DIR, parsing all recent user messages including potentially sensitive content. This is declared in SKILL.md but the volume of data read (up to 80 messages per run) is significant.
src/hunt.js:155 Document clearly what session data is accessed and for how long. This is a data exposure risk if the agent workspace is shared.
中危 文档欺骗
Remote report sending not prominently disclosed in SKILL.md
sendHunterReport() spawns an external node script to send reports. While SKILL.md mentions 'Disable outbound reporting during local tests with SKILL_HUNTER_NO_REPORT=1', the live behavior of sending reports to an external system is not declared as a network:WRITE action in claw.json.
src/hunt.js:572 Declare any external report transmission in claw.json and SKILL.md with the destination endpoint.
声明能力 vs 实际能力
文件系统 通过
声明 READ
→ 推断 WRITE
claw.json declares ["filesystem"]; hunt.js writes SKILL.md, index.js, .hunter.json to SKILLS_DIR — over-claimed but partially tolerable as part of the described feature 命令执行 通过
声明 NONE
→ 推断 WRITE
src/hunt.js:461 execSync(`git clone --depth 1 "${repoUrl}" ...`) and src/hunt.js:418 execSync(`node "${indexPath}" --self-test`) — no shell permission declared anywhere 网络访问 通过
声明 NONE
→ 推断 READ
src/hunt.js:16-23 hardcoded ClawHub API URLs fetched via fetch() — network:READ never declared in claw.json or SKILL.md 环境变量 通过
声明 NONE
→ 推断 READ
src/hunt.js:70 reads SKILL_HUNTER_MAX_INSTALL from process.env; also reads OPENCLAW_ROOT, WORKSPACE_ROOT from path traversal 可疑产物与外联
中危 外部 URL
https://clawhub.ai/wanng-ide/memory-mesh-core README.md:7
中危 外部 URL
https://clawhub.ai/user/terrycarter1985 skill-card.md:7
中危 外部 URL
https://clawhub.ai/terrycarter1985/wanng-ide-auto-skill-hunter skill-card.md:31
中危 外部 URL
https://clawhub.com/api/v1/skills/trending?limit=30 src/hunt.js:16
中危 外部 URL
https://clawhub.com/api/v1/skills?sort=trending&limit=30 src/hunt.js:17
中危 外部 URL
https://clawhub.com/api/v1/skills?limit=30 src/hunt.js:18
中危 外部 URL
https://clawhub.com/api/v1/skills/search?q= src/hunt.js:22
中危 外部 URL
https://clawhub.com/api/v1/skills?q= src/hunt.js:23
依赖与供应链
没有结构化依赖告警。
文件构成
6 个文件 · 1137 行
JavaScript 1 个文件 · 828 行Markdown 3 个文件 · 292 行JSON 2 个文件 · 17 行
需关注文件 · 3
src/hunt.js Undeclared shell:WRITE via execSync — git clone · Undeclared shell:WRITE via execSync — self-test · Undeclared shell:WRITE via spawnSync — report script · Arbitrary code installation from internet without verification · Network access completely absent from declared permissions · Reads session files containing full conversation history · Remote report sending not prominently disclosed in SKILL.md · https://clawhub.com/api/v1/skills/trending?limit=30 · https://clawhub.com/api/v1/skills?sort=trending&limit=30 · https://clawhub.com/api/v1/skills?limit=30 · https://clawhub.com/api/v1/skills/search?q= · https://clawhub.com/api/v1/skills?q=
README.md https://clawhub.ai/wanng-ide/memory-mesh-core
skill-card.md https://clawhub.ai/user/terrycarter1985 · https://clawhub.ai/terrycarter1985/wanng-ide-auto-skill-hunter
其他文件 · SKILL.md · claw.json · _meta.json
安全亮点
skill-card.md contains an unusually detailed 'Known Risks and Mitigations' section that honestly discloses the major risks (session reading, skill modification, report sending, scheduled auto-runs)
SKILL.md includes --dry-run mode for preview-only execution without writes
SKILL.md documents --max-install to cap bulk installs
SKILL.md mentions SKILL_HUNTER_NO_REPORT=1 to disable external reporting
installSkill() skips already-installed skills and never overwrites existing skill folders
validateRunnableSkill() runs --self-test before marking a skill as runnable
Git clone uses --depth 1 to minimize downloaded code surface
HTTP fetch calls have timeouts (12000ms) to prevent indefinite hangs