安全决策报告
sa-master
Skill embeds a hardcoded bearer token and routes all user architecture documents, file paths, and prompts through an external Chinese MCP service (smartmoves.com.cn) without transparent data handling disclosure.
最直接的威胁证据
01
User installs skill and provides BA business documents for architecture design 初始入口 · SKILL.md
02
Skill routes user documents, file paths, and prompts to external smartmoves.com.cn MCP endpoint 权限提升 · mcp-proxy/call_tool.sh
03
Hardcoded bearer token in config.json exposed to all skill installers 最终危害 · mcp-proxy/config.json
为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 3 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 3 步攻击链，另有 2 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
攻击链
01
User installs skill and provides BA business documents for architecture design
初始入口 · SKILL.md:1
02
Skill routes user documents, file paths, and prompts to external smartmoves.com.cn MCP endpoint
权限提升 · mcp-proxy/call_tool.sh:63
03
Hardcoded bearer token in config.json exposed to all skill installers
最终危害 · mcp-proxy/config.json:1
风险分是怎么被拉高的
Hardcoded bearer token in config.json +20
API key sk-Wp9mTx4KvRn7Qd3Fzj exposed in plaintext; committed to skill package
Data exfiltration to external Chinese MCP service +25
All user content, file paths, and architecture documents routed to smartmoves.com.cn
Insufficient data handling transparency +10
SKILL.md declares capability model but omits disclosure of data flow to third-party service
最关键的证据
高危 凭证窃取
Hardcoded API bearer token in config.json
The bearer token sk-Wp9mTx4KvRn7Qd3Fzj is stored in plaintext in mcp-proxy/config.json and embedded in SKILL.md. This credential is committed to the skill package, visible to all installers, and if leaked could grant unauthorized access to the remote MCP service.
mcp-proxy/config.json:1 Remove the api_key from config.json. Use environment variable or secret management for credential injection at runtime.
高危 数据外泄
Undisclosed data routing to third-party Chinese MCP service
SKILL.md declares the skill uses a remote MCP service at smartmoves.com.cn but does not explicitly disclose that ALL user prompts, architecture documents, file paths, and generated outputs are transmitted to this external endpoint. The skill-card.md mentions this as a risk but SKILL.md does not.
SKILL.md:82 Add explicit disclosure in SKILL.md that user content is transmitted to the third-party MCP service. Users must consent to this data flow before using the skill with sensitive materials.
中危 文档欺骗
SKILL.md capability model incomplete
The skill declares no filesystem/network/shell permissions in SKILL.md, implying it operates without resource access. However, call_tool.sh performs network:WRITE (HTTP POST) and filesystem:READ (config reading) operations to function.
SKILL.md:1 Document that the skill performs network communication with the remote MCP service endpoint.
中危 凭证窃取
Bearer token repeated in SKILL.md documentation
The full bearer token Authorization: Bearer sk-Wp9mTx4KvRn7Qd3Fzj is documented in SKILL.md line 85. While intended for documentation purposes, this exposes the credential in a second location.
SKILL.md:85 Remove the actual token value from documentation. Use a placeholder like YOUR_API_KEY instead.
声明能力 vs 实际能力
网络访问 阻止
声明 NONE
→ 推断 READ,WRITE
call_tool.sh:63-69 makes HTTP POST to external remote_url 环境变量 通过
声明 NONE
→ 推断 READ
call_tool.sh reads API_KEY from config.json 文件系统 通过
声明 NONE
→ 推断 READ
call_tool.sh:39-47 reads config.json 可疑产物与外联
中危 外部 URL
https://mcp.smartmoves.com.cn/sa/mcp SKILL.md:82
中危 外部 URL
https://clawhub.ai/user/leo21cn skill-card.md:7
中危 外部 URL
https://clawhub.ai/leo21cn/sa-master skill-card.md:29
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| curl | system | system binary | 否 | Standard system utility |
| python3 | system | system binary | 否 | Standard system utility |
文件构成
5 个文件 · 360 行
Shell 1 个文件 · 180 行Markdown 2 个文件 · 174 行JSON 2 个文件 · 6 行
需关注文件 · 3
mcp-proxy/config.json Hardcoded API bearer token in config.json
SKILL.md Undisclosed data routing to third-party Chinese MCP service · SKILL.md capability model incomplete · Bearer token repeated in SKILL.md documentation · https://mcp.smartmoves.com.cn/sa/mcp
skill-card.md https://clawhub.ai/user/leo21cn · https://clawhub.ai/leo21cn/sa-master
其他文件 · call_tool.sh · _meta.json
安全亮点
skill-card.md explicitly documents known risks including data handling concerns and bearer token exposure
No obfuscation or encoded payloads detected
No direct shell command execution on local system
Remote MCP service provides controlled tool execution rather than arbitrary code execution